Gpg

GNU Privacy Guard [1][2]

gpg --list-keys

Show your keys

gpg --fetch-keys "<URL to keys>"

Import keys

curl "<URL to keys>" -o <outputfile>

Download keys to outputfile

gpg --import <file>

import keys from file

gpg --verify <signature file> <package file>

Verify if the signature file matches the package file. If the file was changed after the signature file was created someone may have tampered it.

If OK the results has: Good signature from ....

If you are sure a key is from a trustworthy person you can trust it in the gpg software directly or from the command-line.

gpg --export-ownertrust > trust.txt

Export the trust database

gpg --import-ownertrust < trust.txt

Import into the trust database