--- a/doc/makefile-variables.txt	Thu May 21 09:51:37 2015 -0700
+++ b/doc/makefile-variables.txt	Thu May 21 16:49:12 2015 -0700
@@ -19,11 +19,7 @@
   $(COMPONENT_ARCHIVE_HASH) to verify the correctness of the archive.  If
   COMPONENT_SIG_URL is present, then COMPONENT_ARCHIVE_HASH needn't be, but its
   presence is strongly encouraged to ensure that the archive contents don't
-  change silently.  If the signature results in a new key being added to
-  tools/.gnupg/pubring.pgp, then as part of your code review, please show the
-  diffs of the text version of the file by running
-      gpg2 --homedir $WS/tools/.gnupg --fingerprint
-  both before and after the change.  Note that when merging, because
+  change silently.  Note that when merging, because
   $WS/tools/.gnupg/pubring.gpg is a binary file, you will have to choose
   the parent or child version.  Pick one, then run:
 	for cset in $(hg log -r 'parents()' -T '{node} '); do

--- a/make-rules/prep-download.mk	Thu May 21 09:51:37 2015 -0700
+++ b/make-rules/prep-download.mk	Thu May 21 16:49:12 2015 -0700
@@ -65,3 +65,6 @@
 #
 $(eval $(call download-rules,))
 $(foreach suffix, $(URL_SUFFIXES), $(eval $(call download-rules,_$(suffix))))
+
+# Needed for signature validation of downloads
+REQUIRED_PACKAGES += crypto/gnupg