You @strong{have to} verify downloaded tarballs authenticity to be sure
that you retrieved trusted and untampered software.

@url{https://www.openssh.com/, OpenSSH} @file{.sig} signature,
@url{PUBKEY-SSH.pub, Public key} and its LibrePGP
@url{PUBKEY-SSH.pub.asc, signature} made with the key above.
Its fingerprint: @code{SHA256:y67HEbtmtxKNjtAha0QZNmX13Izibey8QUzqKnyCzio}.

@example
$ ssh-keygen -Y verify -f PUBKEY-SSH.pub -I tofuproxy@@stargrave.org -n file \
    -s tofuproxy-@value{VERSION}.tar.zst.sig <tofuproxy-@value{VERSION}.tar.zst
@end example
