You *have to* verify downloaded tarballs authenticity to be sure that
you retrieved trusted and untampered software.

=> OpenSSH
.sig signature.
=> public key
=> its LibrePGP signature
Fingerprint: SHA256:OWn7ZttqLqxF1dy7T4uxz2XxIH/0bPp4TIqyPVcbFWU

    $ ssh-keygen -Y verify -f PUBKEY-SSH.pub -I pygost@stargrave.org -n file \
        -s pygost-$v.tar.zst.sig <pygost-$v.tar.zst