When I download GCC, it also has a .sig file, and I think it is provided to verify downloaded file. (I downloaded GCC from here).
.sig
But I can\'t figure out ho
according to this http://gcc.gnu.org/mirrors.html that should be Jakub Jelinek and valid. i don't know where you would get his public key though.