What is the secret to validating the download with the signature?
First, you check that the downloaded file match the SHA-256 checksum in SHA256SUMS.asc
shasum -a 256 bitcoin-0.8.6-linux.tar.gz
Then you check that SHA256SUMS.asc itself has not been tampered with
gpg --verify SHA256SUMS.asc