Email that comes from an address that is "known" to be Tuomo is
sufficient, GPG sig is nice to have but not necessary. Either of those
two options will suffice here, the first is preferred because it will
resolve the license issue entirely, while the second will still require
us to consider whether the Ion license (in the Notion context) is Free.