add a convenience target to download the current SA tarball and corresponding gpg-signature and verify it with SpamAssassin's release key [0]. [0] https://www.apache.org/dist/spamassassin/KEYS