Most tools I download have a SHASUM or MD5 file listed somewhere to checksum files once download.
However, I downloaded Zookeeper recently and was having a heck of a time finding the checksums for it. I could create them myself, but would also like to verify against a public checksum.
Might they also sign releases? How would I go about verifying with GPG.
No, the Apache Foundation does not maintain a centralized checksum repository for binary distributions for any Apache project, nor do they mandate it. Same goes for a signing certificate. Both of these are project-level concerns and must be requested per-project through their project-specific issue tracker.