You *have to* verify downloaded tarballs authenticity to be sure that
you retrieved trusted and untampered software. There are two options:

=> OpenSSH
    .sig signature.
    => public key
    => its LibrePGP signature
    Fingerprint: SHA256:XGKE6v39rIEgSk8U8OyBhcJjpf23f+BEfKKgCW17AxE

    $ ssh-keygen -Y verify -f PUBKEY-SSH.pub -I goredo@stargrave.org -n file \
        -s goredo-$v.tar.zst.sig <goredo-$v.tar.zst

=> KEKS/CM
    .cm SLH-DSA signature.
    => public key
    => its LibrePGP signature

    $ fpr=$(kekspp -v -p /id <PUBKEY-CM.pub)
    $ echo $fpr
    DB81E5A01871AA5715DD1AEBC2E712D8D31EAA088F3030427CAEF8CDEC9D15E1
    $ mkdir -p pubs
    $ ln -s ../PUBKEY-CM.pub pubs/$fpr
    $ cat goredo-$v.tar.zst.cm goredo-$v.tar.zst | cmsigtool -v -d -pubs pubs