From Coinkite's official list of releases: https://raw.githubusercontent.com/Coldcard/firmware/master/releases/signatures.txt The PGP verification is done by the device itself.