You *have to* verify downloaded tarballs authenticity to be sure that
you retrieved trusted and untampered software.

=> OpenSSH
.sig signature.
=> public key
=> its LibrePGP signature
Fingerprint: SHA256:lFUUaPVpUB7p44mJkeKd24G87pUHH1/zTIwGZ+79ASU

    $ ssh-keygen -Y verify -f PUBKEY-SSH.pub -I pygost@stargrave.org -n file \
        -s pygost-$v.tar.zst.sig <pygost-$v.tar.zst