diff --git a/.gitignore b/.gitignore
index a750cec..a629e08 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,8 +1,10 @@
 /bleachbit*/
 /noarch/
 /review-*/
+*.key
 *.log
 *.rpm
+*.sig
 *.tar.bz2
 *.tar.gz
 *.tar.xz
diff --git a/bleachbit.spec b/bleachbit.spec
index c4ca9cb..31d9809 100644
--- a/bleachbit.spec
+++ b/bleachbit.spec
@@ -2,14 +2,19 @@ Name:       bleachbit
 Summary:    Remove sensitive data and free up disk space
 URL:        https://www.bleachbit.org/
 Version:    4.0.0
-Release:    1%{?dist}
+Release:    2%{?dist}
 License:    GPLv3+ and MIT
 BuildArch:  noarch
 
-Source0: https://github.com/%{name}/%{name}/archive/v%{version}/%{name}-%{version}.tar.gz
+# Development and bug reports mostly seem to happen BleachBit's GitHub project, but their documentation points to SourceForge for the GPG public key and signatures, so that's where we'll need to get the source tarballs -- https://docs.bleachbit.org/doc/install-on-linux.html#digital-signatures
+#Source0: https://github.com/%%{name}/%%{name}/archive/v%%{version}/%%{name}-%%{version}.tar.gz
+Source0: https://svwh.dl.sourceforge.net/project/bleachbit/bleachbit/%{version}/bleachbit-%{version}.tar.gz
+Source1: https://svwh.dl.sourceforge.net/project/bleachbit/bleachbit/%{version}/detached_signatures/bleachbit-%{version}.tar.gz.sig
+Source2: https://svwh.dl.sourceforge.net/project/bleachbit/public_key/andrew2019.key
 
 BuildRequires: desktop-file-utils
 BuildRequires: gettext
+BuildRequires: gnupg2
 BuildRequires: libappstream-glib
 BuildRequires: make
 BuildRequires: python3-devel
@@ -40,6 +45,7 @@ to make them run faster.
 
 
 %prep
+%{gpgverify} --keyring='%{SOURCE2}' --signature='%{SOURCE1}' --data='%{SOURCE0}'
 %setup -q
 
 
@@ -100,5 +106,11 @@ update-desktop-database
 
 
 %changelog
+* Tue Jul 14 2020 Andrew Toskin <andrew@tosk.in> - 4.0.0-2
+- Finished unretired package.
+- GPG-verify source tarball.
+- Omit upstream's "BleachBit As Administrator" app launcher, since it's
+  broken on Fedora.
+
 * Wed Apr 22 2020 Andrew Toskin <andrew@tosk.in> - 4.0.0-1
 - Prepare to unretire package after upstream ported to GTK3 and Python3.
diff --git a/sources b/sources
index 5ed77fd..da723ec 100644
--- a/sources
+++ b/sources
@@ -1 +1,3 @@
-SHA512 (bleachbit-4.0.0.tar.gz) = d5c27f08c80193a70d0d15592f980029563fd2153b5a5faee91248f3f89cc351e2ffefc84a39bcec458ef7e5feecd20a2281c122a2bc16f6836015c3f1f8420c
+SHA512 (bleachbit-4.0.0.tar.gz) = cc5acc1762945f8283e70cdd362695211200b339ed78fdb41dc266575a6e0eefd1de7c3cb3d815440cff24665c464086bb32c1fc4392217936ae8d789c024b74
+SHA512 (bleachbit-4.0.0.tar.gz.sig) = 82bb910e25c4bf5efc3a45e0a835d608cee3f6dc4d84153e0a58abbde5e3f3f984c25a51956e5a8fd219ccdaf3edd1dffc828c2048450fb421d1f2c42880d5c5
+SHA512 (andrew2019.key) = f0f378be18baa3490a86fd5e27cc9535145592c46541c8cbf0ed2a8f1164ef172b2550372c20b31ea2299c5d5a5ebada60118173ef79a4b03621d644696ad362