  If you are added to the notification list, security-related emails
  will be sent to you by Django's release manager, and all notification
  emails will be signed with the same key used to sign Django releases;
  that key has the ID ``0x3684C0C08C8B2AE1``, and is available from most
  commonly-used keyservers. 
</s>
  If you are added to the notification list, security-related emails
  will be sent to you by Django's release manager, and all notification
  emails will be signed with the same key used to sign Django releases;
  that key has the ID ``0x3684C0C08C8B2AE1``, and is available from most

keep keep keep keep replace
 Fixed #20868 -- Added an email to django-announce as a security step.

Thanks garrison for the report.
docs/internals/security.txt