Regarding "Can you please check whether you see the same gpg/openssl issues in your log?"
Yes, that message is totally expected. As I said already: My key is not signed yet! Therefore GPG emits a message related to that. IMHO that should not make the check fail though (and in fact it doesn't) because it is equal to the key from the KEYS file. "You should get your key linked to the Apache web of trust <http://www.apache.org/dev/release-signing.html#apache-wot>. Once other people have signed your key, you can update the KEYS file with the signatures you’ve received." (https://jackrabbit.apache.org/filevault/howto_release.html#Appendix_A:_Create_and_add_your_key_to_the_Jackrabbit_KEYS_file <https://jackrabbit.apache.org/filevault/howto_release.html#Appendix_A:_Create_and_add_your_key_to_the_Jackrabbit_KEYS_file>). I will try to get it signed by someone else, but IMHO this is just a nice to have, not mandatory! Konrad
