dev-release: Point to Gerrit docs for info

The Gerrit artifact deployment doc has info on PGP key and Google Cloud
Storage setup that is necessary for making a Gitiles release. Provider a
pointer so that someone making a Gitiles release can find it.

Also, clarify that the git tag should be PGP signed.

Change-Id: I4966ebb1aa34bdd8938f27986c9b1a03c2005a21

Documentation/developer-guide.md

diff --git a/Documentation/developer-guide.md b/Documentation/developer-guide.md
index 398a2e7..1716e80 100644
--- a/Documentation/developer-guide.md
+++ b/Documentation/developer-guide.md
@@ -115,7 +115,10 @@
 
 Gitiles artifacts are published to the [gerrit-maven
 bucket](http://gerrit-maven.storage.googleapis.com/). To release a new version,
-you must have write access to this bucket.
+you must have write access to this bucket. See
+[Deploy Gerrit
+Artifacts](https://gerrit-review.googlesource.com/Documentation/dev-release-deploy-config.html)
+for PGP key setup and Google Cloud Storage access setup.
 
 First, increment `GITILES_VERSION` in `version.bzl`. Technically, Gitiles uses
 the
@@ -129,7 +132,8 @@
 ./tools/maven/mvn.sh deploy
 ```
 
-Tag the release with an annotated tag matching the version number.
+Tag the release with a signed, annotated tag matching the version number, for
+example "v0.4-1".
 
 Once released, Maven projects can consume the new version as long as they point
 at the proper repository URL. Similarly, Bazel projects using the `maven_jar`