doc: make README(.md) more informative by indicating that a GPG key used to sign a release could be a sub-key of a key listed in README(.md) (which itself isn't listed in it)

Update README.md.

Fixes: nodejs#32559

Author: haqer1

README.md

@@ -542,7 +542,8 @@ maintaining the Node.js project.
 
 ### Release Keys
 
-GPG keys used to sign Node.js releases:
+GPG keys used to sign Node.js releases (you may encounter a release signed
+by a sub-key of a key listed below (which itself isn't listed below)):
 
 * **Beth Griggs** <bethany.griggs@uk.ibm.com>
 `4ED778F539E3634C779C87C6D7062848A1AB005C`