As the subject says; the KEYS file must be located at https://www.apache.org/dist/poi/KEYS and the download page must link to it there. http://www.apache.org/dev/release-distribution#download-links and http://www.apache.org/dev/release-download-pages.html#links
Fixed via r1840383 and r1840384 The KEYS file was unchanged / already there - so only the download link needed to be changed