diff --git a/.gitignore b/.gitignore
index eca4808..a2be982 100644
--- a/.gitignore
+++ b/.gitignore
@@ -11,3 +11,4 @@
 /libwpe-1.9.90.tar.xz
 /libwpe-1.9.91.tar.xz
 /libwpe-1.10.0.tar.xz
+/libwpe-1.10.0.tar.xz.asc
diff --git a/gpgkey-5AA3BC334FD7E3369E7C77B291C559DBE4C9123B.gpg b/gpgkey-5AA3BC334FD7E3369E7C77B291C559DBE4C9123B.gpg
new file mode 100644
index 0000000..b7add3a
Binary files /dev/null and b/gpgkey-5AA3BC334FD7E3369E7C77B291C559DBE4C9123B.gpg differ
diff --git a/libwpe.spec b/libwpe.spec
index 2f846f0..80413fa 100644
--- a/libwpe.spec
+++ b/libwpe.spec
@@ -1,12 +1,18 @@
 Name:           libwpe
 Version:        1.10.0
-Release:        1%{?dist}
+Release:        2%{?dist}
 Summary:        General-purpose library for the WPE-flavored port of WebKit
 License:        BSD
 URL:            https://github.com/WebPlatformForEmbedded/%{name}
 Source0:        https://github.com/WebPlatformForEmbedded/libwpe/releases/download/%{version}/%{name}-%{version}.tar.xz
+Source1:        https://github.com/WebPlatformForEmbedded/libwpe/releases/download/%{version}/%{name}-%{version}.tar.xz.asc
+# Created from https://keys.openpgp.org/vks/v1/by-fingerprint/5AA3BC334FD7E3369E7C77B291C559DBE4C9123B
+# $ gpg --import 5AA3BC334FD7E3369E7C77B291C559DBE4C9123B.asc
+# $ gpg2 --export --export-options export-minimal 5AA3BC334FD7E3369E7C77B291C559DBE4C9123B > gpgkey-5AA3BC334FD7E3369E7C77B291C559DBE4C9123B.gpg
+Source2:        gpgkey-5AA3BC334FD7E3369E7C77B291C559DBE4C9123B.gpg
 
 BuildRequires:  gcc-c++
+BuildRequires:  gnupg2
 BuildRequires:  meson
 BuildRequires:  pkgconfig(egl)
 BuildRequires:  pkgconfig(xkbcommon)
@@ -26,6 +32,7 @@ The %{name}-devel package contains libraries, build data, and header
 files for developing applications that use %{name}.
 
 %prep
+%{gpgverify} --keyring='%{SOURCE2}' --signature='%{SOURCE1}' --data='%{SOURCE0}'
 %autosetup -p1 -n libwpe-%{version}
 
 %build
@@ -47,6 +54,9 @@ files for developing applications that use %{name}.
 %{_libdir}/pkgconfig/wpe-1.0.pc
 
 %changelog
+* Fri Mar 26 2021 Michael Catanzaro <mcatanzaro@redhat.com> - 1.10.0-2
+- Add GPG verification of source tarball
+
 * Fri Mar 26 2021 Michael Catanzaro <mcatanzaro@redhat.com> - 1.10.0-1
 - Update to 1.10.0
 
diff --git a/sources b/sources
index 99531c1..6067191 100644
--- a/sources
+++ b/sources
@@ -1 +1,2 @@
 SHA512 (libwpe-1.10.0.tar.xz) = b5634dd71cca70eb960f3c045ad109346ab6ce6b01aa8c8bc8f326d232eb16ac1600757896a4b99720af3c77084351ea4f69e2e2c81b9c32cc8bc12a5c66ba3c
+SHA512 (libwpe-1.10.0.tar.xz.asc) = 8fe0b1523805745a5874c14e11b799ef7ce003052b1985c641ec3915d959c3601cc83de830e9334d5355779412ccb84c8cc3af538324e4ce950c7e857ee371f6