Torgeek
How do I verify a GPG signature?
Since 2021 the signatures are created by one of the official GnuPG release keys (aka certificates) they can be obtained from the GnuPG Homepage or downloaded from public keyservers. Checking the signature is best done via the File Explorer: Right click on the file and use GpgEX options -> verify.
What is a GPG signature?
GPG signatures are widely used by Linux package managers such as apt to verify the integrity of downloaded files. Typically the public key is shipped with the OS, and the private key is owned by the repository maintainers. This way we can safely install software from any mirror or network.
