Here is possibly relevant documentation from CPAN.pm:

Cryptographically signed modules

Since release 1.77 CPAN.pm has been able to verify cryptographically signed module distributions using Module::Signature. The CPAN modules can be signed by their authors, thus giving more security. ...

You will need to have Module::Signature installed, which in turn requires that you have at least one of Crypt::OpenPGP module or the command-line gpg tool installed.

You will also need to be able to connect over the Internet to the public keyservers, like pgp.mit.edu, and their port 11731 (the HKP protocol).

Well, I've got Module::Signature and gpg installed, and I'm connected to the Internet. What am I missing?

jimk