Got the latest Tor Browser Bundle (220.127.116.11) and tried to verify.
Here's the result:
gpg --verify /Users/user/Downloads/TorBrowserBundle-18.104.22.168-osx32_en-US.zip.asc /Users/user/Downloads/TorBrowserBundle-22.214.171.124-osx32_en-US.zip gpg: Signature made za 15 feb 12:46:23 2014 CET using RSA key ID 63FEE659 gpg: Good signature from "Erinn Clark <firstname.lastname@example.org>" gpg: aka "Erinn Clark <email@example.com>" gpg: aka "Erinn Clark <firstname.lastname@example.org>" gpg: WARNING: This key is not certified with a trusted signature! gpg: There is no indication that the signature belongs to the owner. Primary key fingerprint: 8738 A680 B84B 3031 A630 F2DB 416F 0610 63FE E659
Why the WARNING, why is that key not certified and why a space between A603 and F2DB. Also, Erinn Clark has a newer key of sept. 2013 in stead of oct. 2003. Why doesn't GPGTools use the latest key? Thanks, SK.