browse to http://www.apache.org/dist/spark/spark-2.1.0/ or the version you want
download the tag and corresponding asc files
wget http://www.apache.org/dist/spark/spark-2.1.0/spark-2.1.0-bin-hadoop2.7.tgz
wget http://www.apache.org/dist/spark/spark-2.1.0/spark-2.1.0-bin-hadoop2.7.tgz.asc
$ wget http://www.apache.org/dist/spark/KEYS
$ gpg --import KEYS
$ gpg --verify spark-2.1.0-bin-hadoop2.7.tgz.asc spark-2.1.0-bin-hadoop2.7.tgz
gpg: Signature made Thu Dec 15 18:18:33 2016 PST using RSA key ID FC8ED089
gpg: Good signature from "Patrick Wendell " [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg: There is no indication that the signature belongs to the owner.
Primary key fingerprint: EEDA BD1C 71C5 48D6 F006 61D3 7C6C 105F FC8E D089
$ gpg --keyserver pgpkeys.mit.edu --recv-key FC8ED089
gpg: requesting key FC8ED089 from hkp server pgpkeys.mit.edu
gpg: key FC8ED089: "Patrick Wendell " not changed
gpg: Total number processed: 1
gpg: unchanged: 1
$ gpg --verify spark-2.1.0-bin-hadoop2.7.tgz.asc spark-2.1.0-bin-hadoop2.7.tgz
