Of course, but when all you have to verify that a change is by the copyright holder/project owner is a signature, the whole situation becomes very murky. The o

Of course, but when all you have to verify that a change is by the copyright holder/project owner is a signature, the whole situation becomes very murky. The only authenticity test that I can think of is to actively distribute a fork of TrueCrypt using the new license and wait to get sued. If you get sued by the copyright holder (who would have to come out of anonymity to sue), then you can be sure that the new license was unauthorized. Not the safest way to test authenticity, but it should work.