I changed our dependency verification keys file to use armor format. In theory, that makes it no longer a binary file in terms of compliance with ASF release policy and we could now include it with our source releases. That would speed up the build for folks building from source with dependency verification turned on - since currently it will try to verify signatures against public key servers if that file is missing. I haven't tweaked the build to include that file yet.
Cheers, Paul.
