Title says it all. You can download full source, patches, changelogs, whatever for multiple versions directly from the front page of kernel.org. However, if you want to the GPG sig of the source, you have to click down into the archives. I assume there must be a sound reason for this, but for the life of me I cannot figure out what it is.

Not linking the signing key[s] I understand, but why not the sig?

I emailed kernel.org to ask, and was told to read
http://www.kernel.org/signature.html
which was supposedly linked from the FAQ. Well,

1. this page does not seem to answer my question, and
2. it's not actually linked from FAQ, either.

Thanks,
quiescere

Well since this isn't kernel.org, why not send them an e-mail and ask them?

I agree NyteOwl, in fact, it bothers me too, so I will also e-mail them.

From my original post starting the thread:
As the response was unhelpful, I turned here hoping more eyes meant more time for a thoughtful reply.

@quiescere: The folks you were/are communicating with are likely overworked and absurdly busy.

I agree that it sounds like their reply didn't address your question. And your point is a good one: pubkeys (to verify signatures) should probably be more prominently displayed and more easily discovered.

You might reply again to the thread you've already started with them. Use clear, succinct English, and request an actionable item.

Good luck pursuing it further.

-------

Edited to add: the keys are actually linked to on the front page. But they're way, way below the fold. You have to scroll down to see them. See attached PNG for a screenshot.

Attached Thumbnails

 

anomie, I sincerely appreciate the attention you've given my question, but this is still not quite what I am asking. I'm not as concerned about the public keys, which only need to be retrieved once. It's the signature files that must be downloaded with each new kernel version that interest me.

Ah, gotcha. The signed MD5 / SHA1 / whatever digests of the kernel. Yes, that's just as important as the keys themselves if you wish to verify the kernel you're downloading hasn't been tampered with.

Yes, especially important since kernel.org got hacked a while back.

I also would like to know more about the hack, but no info was released on it.