Every release carries a checksum manifest and a detached signature over that manifest. The public key is here.