Package: src:cmake Version: 3.3.2-1 Looks like cmake.org now expose a key to check tarballs:
Cryptographic Hashescmake-3.4.0-rc1-SHA-256.txt cmake-3.4.0-rc1-SHA-256.txt.asc See: https://cmake.org/download/ Please import it (as debian/upstream/signing-key.asc)
