tto / docs / crypto / pgp gpg

use gpg --import to import a public key.

use gpg --verify to verify signatures.

gpg uses a manifest file that contains signatures and filenames.