Spring Framework JARs released on Maven Central are signed. You'll find more information about the key here: https://spring.io/GPG-KEY-spring.txt

Please see the Spring Framework Versions wiki page.

Please see https://spring.io/security-policy.