Page History

...

• There are numerous smaller vendors and several large ones, including IBM, HP, Sun, and Novell, who offer Tomcat consulting and support services, including application auditing, environment assessments, and risk analysis.
• There are numerous vendors in addition to the above consultants, like SpringSource (formerly Covalent) and JBoss, who offer 24/7/365 enterprise-level support for Tomcat.
• The Tomcat mailing lists are extremely active and contain members of many of the above organizations, including contractors available for hire.
  

...

All Tomcat releases are signed using the Release Manager's PGP key. The key is also available in the KEYS file that ships with every Tomcat release. The same KEYS file is also available in the Tomcat CVS SVN repository (here). The PGP signatures are available on all the Tomcat download pages, and can (and should!) be used to verify the release really is the signed distribution.

As for tampering: every Tomcat release is also digested using the MD5 algorithm as specified in RFC1321. The MD5 digest is included in all the download pages. Users run MD5 on their local machine to verify that the digest of what they downlaoded downloaded is the same as that published in the Apache download pages. That way, users are assured the distribution has not been modified since the Release Manager signed it.

...