Hi Valentin, It seems that the key used to sign the archive is no longer the one from the automake group.
I signed it. I'm one of the listed admins of the automake group on savannah (https://savannah.gnu.org/projects/automake/), so I don't know what you mean by "from the automake group". Jim is still the official automake maintainer, but my key was added as an allowed uploader since (unfortunately) he doesn't have much time for automake any more. gpg --verify automake-1.18.tar.xz.sig works for me. Best, Karl