gpg: using RSA key EA18E7F040C41DDAEFE9AA0F4AC18DE1112E1490 gpg: Good signature from "Simon Gaiser (Qubes Security Pack signing key)" [full] $ cd ../canaries/ $ gpg --verify canary-034-2023.txt.sig.marmarek canary-034-2023.txt gpg: Signature made Thu 02 Mar 2023 03:51:48 AM PST gpg: using RSA key 2D1771FE4D767EDC76B089FAD655A4F21830E06A gpg: Good signature from "Marek Marczykowski-Górecki (Qubes security pack)" [full] $ gpg --verify canary-034-2023.txt.sig.simon canary-034-2023.txt gpg: Signature made Thu 02 Mar 2023 01:47:52 AM PST gpg: using RSA key EA18E7F040C41DDAEFE9AA0F4AC18DE1112E1490 gpg: Good signature from "Simon Gaiser (Qubes Security Pack signing key)" [full] Again, the exact output will differ, but the final line of output from each gpg --verify command should always start with gpg: Good signature from... followed by an appropriate key. For this announcement (QSB-090), the commands are: $ gpg --verify qsb-090-2023.txt.sig.marmarek qsb-090-2023.txt $ gpg --verify qsb-090-2023.txt.sig.simon qsb-090-2023.txt You can also verify the signatures directly from this announcement in addition to or instead of verifying the files from the qubes-secpack. Simply copy and paste the QSB-090 text into a plain text file and do the same for both signature files. Then, perform the same authentication steps as listed above, substituting the filenames above with the names of the files you just created.