How may I check Mobian images' signature?

In case of official Mobian images, at https://images.mobian-project.org/ following file types are made available:

Mobian images are signed with one of the keys made available in the mobian-archive-keyring Debian package: please make sure both mobian-archive-keyring and gpg are installed on your Debian PC.

For users not utilizing Debian, you can download the key from the Salsa Repository: https://salsa.debian.org/Mobian-team/mobian-keyring/-/tree/master?ref_type=heads.

You can also download it from a keyserver utilizing the following command: 

gpg --keyserver pgp.mit.edu --recv-keys D569936C7E32F193CBAAEC48393F924A855FB27D

The following commands can be used to verify a trusted key has been used for signing the .sha256sums text file, which includes the SHA256-sum of the .tar.xz archive and thus identifies it unambiguously. 

$ gpg --keyring --verify mobian-qcom-plasma-mobile-20250126.sha256sums.sig mobian-qcom-plasma-mobile-20250126.sha256sums
gpg: Signature made Sun Jan 26 04:24:18 2025 CET
gpg:                using RSA key 970B1DD5FF63506F85001159951D61F2BC232697
gpg:                issuer "admin@mobian-project.org"
gpg: Good signature from "Mobian Project <admin@mobian-project.org>" [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: D569 936C 7E32 F193 CBAA  EC48 393F 924A 855F B27D
     Subkey fingerprint: 970B 1DD5 FF63 506F 8500  1159 951D 61F2 BC23 2697

After verifying the sha256sums, you can utilize them to verify the other files utilizing it. Replace the file name with the .sha256sums file associated with the download you are attempting to verify: 

$ cksum --algorithm=sha256 --check mobian-librem5-plasma-mobile-20250803.sha256sums
mobian-librem5-plasma-mobile-20250803.img.xz: OK
mobian-librem5-plasma-mobile-20250803.img.bmap: OK

Your image is fully verified once you have checked both the GPG signature and the sha256sum hash.