This really has nothing to do with Tor Browser and is a general Mac issue. I don't use Macs but I googled this issue and found the fix here.
The summary is that you need to go into your security settings and tell your Mac to open it anyway.
The WKD URL for the validation key for TBB is
However, using the command given in the official instructions doesn't contact the public keyserver network, so you wouldn't be at risk of that attack anyway, even if you were a high risk user.
There are two versions of the gpg command available in Ubuntu 16.04, in separate packages:
gnupg, which is GnuPG version 1.4.20; and
gnupg2, which is GnuPG version 2.1.11.
The --locate-keys option was added in 2.0.10, as was the nodefault value for --auto-key-locate. Given that you're unable to use the --locate-keys option, I strongly suspect that the ...