--- /dev/null
+You @strong{have to} verify downloaded tarballs authenticity to be sure
+that you retrieved trusted and untampered software. There are two options:
+
+@table @asis
+
+@item @url{https://www.openpgp.org/, OpenPGP} @file{.asc} signature
+ Use @url{https://www.gnupg.org/, GNU Privacy Guard} free software
+ implementation.
+ For the very first time it is necessary to get signing public key and
+ import it. It is provided @url{PUBKEY-PGP.asc, here}, but you should
+ check alternate resources.
+
+@verbatim
+pub rsa2048/0xCD5CD01F55343D88 2019-12-08
+ 9B27 640B A784 37EC 6D4A CA6C CD5C D01F 5534 3D88
+uid GoCheese releases <gocheese@cypherpunks.ru>
+@end verbatim
+
+@example
+$ gpg --auto-key-locate dane --locate-keys gocheese at cypherpunks dot ru
+$ gpg --auto-key-locate wkd --locate-keys gocheese at cypherpunks dot ru
+@end example
+
+@item @url{https://www.openssh.com/, OpenSSH} @file{.sig} signature
+ @url{PUBKEY-SSH.pub, Public key} and its OpenPGP
+ @url{PUBKEY-SSH.pub.asc, signature} made with the key above.
+ Its fingerprint: @code{SHA256:Akj/MCtxCjPphrgWub2BeChqHDhLMABTYLL/MzqTN+s}.
+
+@example
+$ ssh-keygen -Y verify -f PUBKEY-SSH.pub -I gocheese@@cypherpunks.ru -n file \
+ -s gocheese-@value{VERSION}.tar.zst.sig < gocheese-@value{VERSION}.tar.zst
+@end example
+
+@end table