Verify upstream sources with GPG

This is now a recommended thing to do:
https://docs.fedoraproject.org/en-US/packaging-guidelines/#_source_file_verification

Regardless if it adds actual security, it should prevent problems like this one:
https://mail.python.org/archives/list/python-dev@python.org/message/OYNQS2BZYABXACBRHBHV4RCEPQU5R6EP/

.gitignore

@@ -9,3 +9,4 @@ Python-3.5.1.tar.xz
 /Python-3.5.8rc1.tar.xz
 /Python-3.5.8rc2.tar.xz
 /Python-3.5.8.tar.xz
+/Python-3.5.8.tar.xz.asc

python35.spec

@@ -79,8 +79,10 @@
 # ==================
 # Top-level metadata
 # ==================
-Summary: Version 3.5 of the Python programming language
 Name: python%{pyshortver}
+Summary: Version %{pybasever} of the Python programming language
+URL: https://www.python.org/
+
 %global general_version %{pybasever}.8
 #global prerel ...
 %global upstream_version %{general_version}%{?prerel}
@@ -115,6 +117,7 @@ BuildRequires: gdbm-devel
 BuildRequires: glibc-all-langpacks
 BuildRequires: glibc-devel
 BuildRequires: gmp-devel
+BuildRequires: gnupg2
 BuildRequires: libffi-devel
 BuildRequires: libGL-devel
 BuildRequires: libX11-devel
@@ -164,7 +167,9 @@ Provides: python%{pybasever} = %{version}-%{release}
 # Source code and patches
 # =======================
 
-Source: http://www.python.org/ftp/python/%{general_version}/Python-%{upstream_version}.tar.xz
+Source0: %{url}ftp/python/%{general_version}/Python-%{upstream_version}.tar.xz
+Source1: %{url}ftp/python/%{general_version}/Python-%{upstream_version}.tar.xz.asc
+Source2: %{url}static/files/pubkeys.txt
 
 # Supply an RPM macro "py_byte_compile" for the python3-devel subpackage
 # to enable specfiles to selectively byte-compile individual files and paths
@@ -421,8 +426,6 @@ Patch5001: python3-powerppc-arch.patch
 # Additional metadata, and subpackages
 # ======================================================
 
-URL: http://www.python.org/
-
 # We'll not provide this, on purpose
 # No package in Fedora shall ever depend on this
 # Provides: python(abi) = %%{pybasever}
@@ -452,6 +455,7 @@ or older Fedora releases.
 # ======================================================
 
 %prep
+%gpgverify -k2 -s1 -d0
 %setup -q -n Python-%{upstream_version}
 
 %if 0%{?with_systemtap}

sources

@@ -1 +1,2 @@
 SHA512 (Python-3.5.8.tar.xz) = ef36b234786a15592f69b0cd38421373e4713e314de847ebe6da4249fb09c467ba2a8d713dde355330ea0be995be4528912f71774e9418dee285ed891d2d2bd5
+SHA512 (Python-3.5.8.tar.xz.asc) = 9181d8e9fdb71eda72458b52cdf97d613c09bd58cd8dc46e3a749cffbbed28e3792d104a5234a60d0f454c8b73df7b989f4984e95a28155fa7186e6dadae8554