Verifying a release

The steps verify the signature of SHA256SUMS with the public key K1, then each downloaded file against the list — with OpenSSL 3, without the app and without Palomar.

On macOS the system’s openssl is LibreSSL and lacks the command of step 4; install OpenSSL 3 and use that one.

Check that OpenSSL 3 runs:
```
openssl version
```
Download the release’s files together with SHA256SUMS and SHA256SUMS.sig into the same folder.
Save the public key K1 as k1.pub.pem and compare its fingerprint with the one shown under “Keys”:
The release keys
```
openssl pkey -pubin -in k1.pub.pem -outform DER | openssl dgst -sha256 -r
```

Verify the signature of SHA256SUMS with the public key:

openssl pkeyutl -verify -rawin -pubin -inkey k1.pub.pem -in SHA256SUMS -sigfile SHA256SUMS.sig

The expected answer:

Signature Verified Successfully

Check each downloaded file against SHA256SUMS — shasum on macOS, sha256sum on Linux:
```
shasum -a 256 -c SHA256SUMS
```
```
sha256sum -c SHA256SUMS
```