I'm having problems verifying the detached signature. Rodric, did you perhaps use a new key by mistake that needs to be uploaded to the openwhisk KEYS file?
Daves-MacBook-Pro:rc1 dgrove$ gpg --verify openwhisk-client-js-3.21.0-sources.tar.gz.asc openwhisk-client-js-3.21.0-sources.tar.gz gpg: Signature made Sat Feb 1 10:27:13 2020 EST gpg: using RSA key 066DF39E0294C7FF90953B76A6E46CAF938D5BAF gpg: Can't check signature: No public key --dave