I just downloaded `http://deb.torproject.org/torproject.org/rpm/fc15/tor-0.2.2.35-tor.0.rh15.i686.rpm{,.asc}` and got an error when I checked the signature. However a `head -n 1 *.asc` reveals: `-----BEGIN PGP PUBLIC KEY BLOCK-----` and not `-----BEGIN PGP SIGNATURE-----` I downloaded some asc-files and made a diff. They were all the same. So the asc-files are not signatures, but public keys. So from my point of view those are no valid signatures. This should be corrected.