Cannot verify Apache James download because the certificate expired

[John Meloro]

I have downloaded Apache James source and binary.

I have attempted to verify the digital signature associated with the
downloads using GPG4Win/Kleopatra.

However, in both cases the certificate used to sign expired in February
2016.

Does anyone know how to get the source and binary re-signed with a
certificate that has not expired?

Or a workaround to verify?

Thanks,
John M.