You're not associating keys with an account; you're associating keys with a maven namespace. I guess you do have to have an account to post a artifact into a st

You're not associating keys with an account; you're associating keys with a maven namespace. I guess you do have to have an account to post a artifact into a staging repository, but at the end of the day, the keys have to match the namespace and to quote Stone Cold Steve Austin: And thats the bottom line. So for instance, I now control this maven namespace: com.github.exabrial When I created my Sonatype account, I signed up and verified my email. I then had to give them a PGP public key and told them I wanted to control that namespace. Since the namespace was un-occupied, they were like sure np. Now, whenever I publish artifacts into that maven namespace, they must be signed with that PGP key. As an example, you can see the associated signature files for all of the artifacts for this release in the repository: https://repo1.maven.org/maven2/com/github/exabrial/logback-openwire-appender/1.1.0/ https://repo1.maven.org/maven2/com/github/exabrial/logback-o... repo here: https://github.com/exabrial/logback-openwire-appender https://github.com/exabrial/logback-openwire-appender if you want to look at the build configuration in the pom.xml