Maven distribution signing key not found on keys.openpgp.org

[AnttiKuusela]

Checklist

• I have looked into the Readme and Examples, and have not found a suitable solution or answer.
• I have looked into the API documentation and have not found a suitable solution or answer.
• I have searched the issues and have not found a suitable solution or answer.
• I have searched the Auth0 Community forums and have not found a suitable solution or answer.
• I agree to the terms within the Auth0 Code of Conduct.

Description

The PGP key 0xD8E6762C6CB29F64 used for signing maven distribution of java-jwt 4.6.0 (https://repo.maven.apache.org/maven2/com/auth0/java-jwt/4.6.0/java-jwt-4.6.0.jar) and jwks-rsa 0.24.1, is not available on https://keys.openpgp.org, causing signature verification, using org.simplify4u.plugins.pgpverify-maven-plugin, to fail. This is the same key as in the past, used for java-jwt 4.5.2 and older releases.

Reproduction

Create a maven project that uses java-jwt and jwks-rsa as dependency.

    <dependency>
      <groupId>com.auth0</groupId>
      <artifactId>java-jwt</artifactId>
      <version>4.6.0</version>
    </dependency>
    <dependency>
      <groupId>com.auth0</groupId>
      <artifactId>jwks-rsa</artifactId>
      <version>0.24.1</version>
    </dependency>

Set up signature verification

      <plugin>
        <groupId>org.simplify4u.plugins</groupId>
        <artifactId>pgpverify-maven-plugin</artifactId>
        <version>1.19.1</version>
        <executions>
          <execution>
            <goals>
              <goal>check</goal>
            </goals>
          </execution>
        </executions>
      </plugin>

Run mvn verify

Verification fails

[ERROR] com.auth0:java-jwt:pom:4.6.0 PGP key 0xD8E6762C6CB29F64 not found on keyserver

Additional context

Using maven version 3.9.16

java-jwt version

4.6.0

Java version

21.0.12