diff --git a/.gitignore b/.gitignore
index 2daf75f..36bedb4 100644
--- a/.gitignore
+++ b/.gitignore
@@ -30,3 +30,4 @@
 /trust-extract-compat
 /p11-kit-0.23.18.1.tar.gz
 /p11-kit-0.23.19.tar.xz
+/p11-kit-0.23.19.tar.xz.sig
diff --git a/gpgkey-462225C3B46F34879FC8496CD605848ED7E69871.gpg b/gpgkey-462225C3B46F34879FC8496CD605848ED7E69871.gpg
new file mode 100644
index 0000000..30cd729
Binary files /dev/null and b/gpgkey-462225C3B46F34879FC8496CD605848ED7E69871.gpg differ
diff --git a/p11-kit.spec b/p11-kit.spec
index 0a779d0..bba68e3 100644
--- a/p11-kit.spec
+++ b/p11-kit.spec
@@ -7,8 +7,10 @@ Summary:        Library for loading and sharing PKCS#11 modules
 License:        BSD
 URL:            http://p11-glue.freedesktop.org/p11-kit.html
 Source0:        https://github.com/p11-glue/p11-kit/releases/download/%{version}/p11-kit-%{version}.tar.xz
-Source1:        trust-extract-compat
-Source2:        p11-kit-client.service
+Source1:        https://github.com/p11-glue/p11-kit/releases/download/%{version}/p11-kit-%{version}.tar.xz.sig
+Source2:        gpgkey-462225C3B46F34879FC8496CD605848ED7E69871.gpg
+Source3:        trust-extract-compat
+Source4:        p11-kit-client.service
 
 BuildRequires:  gcc
 BuildRequires:  libtasn1-devel >= 2.3
@@ -19,6 +21,7 @@ BuildRequires:  bash-completion
 # Work around for https://bugzilla.redhat.com/show_bug.cgi?id=1497147
 # Remove this once it is fixed
 BuildRequires:  pkgconfig(glib-2.0)
+BuildRequires:  gnupg2
 
 %description
 p11-kit provides a way to load and enumerate PKCS#11 modules, as well
@@ -67,6 +70,8 @@ feature is still experimental.
 
 
 %prep
+gpgv2 --keyring %{SOURCE2} %{SOURCE1} %{SOURCE0}
+
 %autosetup -p1
 
 %build
@@ -80,11 +85,11 @@ make install DESTDIR=$RPM_BUILD_ROOT
 mkdir -p $RPM_BUILD_ROOT%{_sysconfdir}/pkcs11/modules
 rm -f $RPM_BUILD_ROOT%{_libdir}/*.la
 rm -f $RPM_BUILD_ROOT%{_libdir}/pkcs11/*.la
-install -p -m 755 %{SOURCE1} $RPM_BUILD_ROOT%{_libexecdir}/p11-kit/
+install -p -m 755 %{SOURCE3} $RPM_BUILD_ROOT%{_libexecdir}/p11-kit/
 # Install the example conf with %%doc instead
 rm $RPM_BUILD_ROOT%{_sysconfdir}/pkcs11/pkcs11.conf.example
 mkdir -p $RPM_BUILD_ROOT%{_userunitdir}
-install -p -m 644 %{SOURCE2} $RPM_BUILD_ROOT%{_userunitdir}
+install -p -m 644 %{SOURCE4} $RPM_BUILD_ROOT%{_userunitdir}
 
 %check
 make check
@@ -146,6 +151,7 @@ fi
 %changelog
 * Wed Jan 22 2020 Daiki Ueno <dueno@redhat.com> - 0.23.19-1
 - Update to upstream 0.23.19 release
+- Check archive signature in %%prep
 
 * Mon Sep 30 2019 Daiki Ueno <dueno@redhat.com> - 0.23.18.1-1
 - Update to upstream 0.23.18.1 release
diff --git a/sources b/sources
index 5b6c8f3..c49b5ca 100644
--- a/sources
+++ b/sources
@@ -1 +1,2 @@
 SHA512 (p11-kit-0.23.19.tar.xz) = 1a7feb2c14381f2ca87386b6a81f46cfb27ccce70ad87a2fc86726e2827b49971958e40c4fc54df01df7570d82058afe82d21c5b3c59fb8310aa641d3b370da2
+SHA512 (p11-kit-0.23.19.tar.xz.sig) = 4757347a822f9ea82aa0b6771776a02056786a9371fdb2a3acc14f0fee724a80de2ea9b270aa99ef27db1b5aebadfdacf52013092ebcfaeb37cf9b350c850435