[lmm]

There's a plugin for checking it in maven ( http://www.simplify4u.org/pgpverify-maven-plugin/plugin-info... ) that allows pinning the keys.

Ranges are rare but I'm not sure why - maven actually has very good support for them. I guess it's just that they're not the default?

[oblio]

Version ranges can create inconsistent builds. That's why they're not default and that's why they're not really recommended.