Tor Browser-how to verify signature? -- Signatures failing in 3.6.2

Question

I can get 3.5 to verify, but NOT 3.6.2. So, either the packages are contaminated, or I'm missing something. The detailed instructions are here, Tor Browser-how to verify signature? and also on the Tor official site if you need them. They work, just not for me with v3.6.2.

Here are the details:

I downloaded from both the main download page and also from https://archive.torproject.org/tor-package-archive/torbrowser/3.6.2/ and, they all match ALL the hashes of each other.

[__] torbrowser-install-3.6.2_en-US.exe 08-Jun-2014 22:10 26M
SHA-1 = 0F1788F34F6C803025BB6F541C974DDA788DF09F

[TXT] torbrowser-install-3.6.2_en-US.exe.asc 09-Jun-2014 21:52 473
SHA-1 = C5DB2F8EA8305472C750F452D19F7C4DF9006D0C

Running the checks, here are the results, and failed end result:

C:\Users\MEuser>"C:\Program Files (x86)\Gnu\GnuPg\gpg2.exe" --keyserver x-hkp://pool.sks-keyservers.net --recv-keys 0x416F061063FEE659
gpg: requesting key 63FEE659 from hkp server pool.sks-keyservers.net
gpg: key 63FEE659: "Erinn Clark " not changed
gpg: Total number processed: 1
gpg: unchanged: 1

C:\Users\MEuser>"C:\Program Files (x86)\Gnu\GnuPg\gpg2.exe" --fingerprint 0x416F061063FEE659
pub 2048R/63FEE659 2003-10-16
Key fingerprint = 8738 A680 B84B 3031 A630 F2DB 416F 0610 63FE E659
uid Erinn Clark
uid Erinn Clark
uid Erinn Clark
sub 2048R/EB399FD7 2003-10-16

C:\Users\MEuser>"C:\Program Files (x86)\Gnu\GnuPg\gpg2.exe" --verify "C:\Users\MEuser\Downloads\torbrowser-install-3.6.2_en-US.exe.asc" "C:\Users\MEuser\Downloads\torbrowser-install-3.6.2_en-US.exe"
gpg: Signature made 06/09/14 17:52:45 Eastern Daylight Time using RSA key ID 63FEE659
gpg: BAD signature from "Erinn Clark "

Also, here is the identical syntax used in v 3.5 which DOES verify!

C:\Users\MEuser>"C:\Program Files (x86)\Gnu\GnuPg\gpg2.exe" --verify "C:\Users\MEuser\Downloads\torbrowser-install-3.5_en-US.exe.asc" "C:\Users\MEuser\Downloads\torbrowser-install-3.5_en-US.exe"
gpg: Signature made 12/17/13 15:41:17 Eastern Standard Time using RSA key ID 63FEE659 gpg: Good signature from "Erinn Clark "
gpg: aka "Erinn Clark "
gpg: aka "Erinn Clark "
gpg: WARNING: This key is not certified with a trusted signature!
gpg: There is no indication that the signature belongs to the owner.
Primary key fingerprint: 8738 A680 B84B 3031 A630 F2DB 416F 0610 63FE E659

ALSO -- Here's the ASC file text for the 3.6.2 bundle:

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQEcBAABCAAGBQJTliytAAoJEEFvBhBj/uZZRz4H/A3bBD/yNIVHl78Mk3V5Y3Ge
nbpEEixEwwVvJT+l13tU8wgMks6LHqqiC2xCFO02snbqR4gB039vhLGQzUhjbqZQ
xVH9CQa4sFxKO78mxVURwZmWom0ofN/dqtKEEhJp8B8AFjJkPny2Fl8smFauS6+S
kRBHRlSKhtuEkjl3YqmK8/UfWX9ywrBbZSpGnBBwQ2T0AMSGbiGPgBqUdnjq5eLd
330l16Yi6m7TLPTq0I5E/z2ZvgFZUyM7Qm4UcpGP+Ui9g34hnlBaj2PljuUcXjBw
1O9oauOu1lzfbFWdvZnVjdOsMb8VidGu2qj6IPVWYb+jbeFmWzA8ItTyO0cJxB4=
=vyxe
-----END PGP SIGNATURE-----

Answer 1

After emailing with support, they pointed me to the new version, 3.6.3 that came out today. And, THIS version DID VERIFY!

So, 3.6.2 is still suspect in my book.

Version 3.6.3, which was released July 25th, 2014, at 2130, verifies just fine using the strings in my post above, just by changing the username and the version, (and verifying the path).

You can download at the SSL site at one of the two links:

Easy for Windows
https://www.torproject.org/download/download-easy.html.en

All versions, languages, and OS's of 3.6.3
https://archive.torproject.org/tor-package-archive/torbrowser/3.6.3/