PGP signatures

All files are signed with my Qubes OS Signing key.
You will need to get this from a keyserver, or two, to make sure all is fine: keyserver.ubuntu.com
I suggest you do this in a disposable.
You can also check the Qubes users mailing list, the Forum, or look at my page on github, which also contains a copy of my signing key.
You must confirm that the key is correct

Once you have copies of the key, check the fingerprint:
gpg -n --import --import-options import-show unman.pub
replacing unman.pub with the path to the key. This will show the fingerprint of the primary key:

pub   rsa4096 2016-06-25 [SC]
      4B1F 400D F256 51B5 3C41  41B3 8B3F 30F9 C8C0 C2EF
uid           [ unknown] unman (Qubes OS signing key) 
sub   rsa4096 2016-06-27 [S] [expires: 2027-06-30]
sub   rsa4096 2016-06-25 [E]

I use a subkey to sign packages. You can read about the idea behind this in this post by Alex Cabal:
Creating the Perfect GPG Keypair

You can see details of the subkeys by running:
gpg --show-keys --with-subkey-fingerprint unman.pub


pub   rsa4096 2016-06-25 [SC]
      4B1F400DF25651B53C4141B38B3F30F9C8C0C2EF
uid                      unman (Qubes OS signing key) 
sub   rsa4096 2016-06-27 [S] [expires: 2027-06-30]
      7473414DF9A181A45244BDACFDD1B8244731B36C
sub   rsa4096 2016-06-25 [E]
      F4A29C5E2E90B2E0732358E46233CD8FA59A87A8

The signing subkey is marked with "S". Check that it is in date. Once you are satisfied that you have a genuine key, you can use it to validate packages, or install templates.

Copying to dom0

If you need to copy the key to dom0, you can do this in dom0 like this:
qvm-run -p QUBE 'cat PATH_TO_KEY' > unman.asc
Replace QUBE with the name of the qube where you downloaded the key
Replace PATH_TO_KEY with the full path to the key in that qube

Packages

For rpm packages, you must import the key in to the RPM keyring.
sudo rpmkeys --import PATH_TO_KEY

Templates

To use templates from this site all you have to do is copy the key to /etc/qubes/repo-templates/keys You can then use qvm-template as normal, either to manually install templates, or to install from the 3isec repository.

Key problems

Sometimes you may get a message that a key does not contain the correct subkey or the key is invalid. Usually this is because the key has expired. I renew the signing sub key every year if I am certain that the signing key hasnot been compromised.
The simplest way to fix this is to download a fresh copy of the key, check it's validity, and then use it as detailed above.
For use with templates, all you have to do is copy the new qube to /etc/qubes/repo-templates/keys, overwriting the old key.
For packages, the best way to guarantee that you are using the new key is to first delete the old key from the rpm keyring, and then import the new:


sudo rpmkeys --list
sudo rpmkeys --delete UUID
sudo rpmkeys --import NEW_KEY

UUID is the UUID of the unman signing key from the first command.
NEW_KEY is the path to the new key

unman