Hi Gary, The Commons Lang 3.21.0 release is signed with F4DD59C90148BDC52BEB90A4530AA5F25C25011F. That key is in https://downloads.apache.org/commons/KEYS and named in the RC2 vote, but https://people.apache.org/keys/committer/ggregory.asc doesn't list it yet. It only shows 2DB4F1EF0FA761ECC4EA935C86FDC7E2A11262CB and CFF3FFFC320345199BDBDAC659BA7BFEAD3D7F94.
We pin signing keys per artifact in our build, and we found this while checking the key change. Adding the fingerprint at https://id.apache.org should make it show up there. Thanks for the release, Valentin Nastasache
