Spring Framework JARs released on Maven Central are signed. You'll find more information about the key here: https://spring.io/GPG-KEY-spring.txt
Please see the Spring Framework Versions wiki page.
Please see https://spring.io/security-policy.