Source kits are now PGP signed.  Get my public key off the key servers,
or grab steve.pgp and snarf the public key with mailcrypt.