The releases are tagged and signed in the PHP Git Repository. The following official GnuPG keys of the current PHP Release Manager can be used to verify the tags:
pub 4096R/70D12172 2017-04-14 [expires: 2024-04-21]
Key fingerprint = 1729 F839 38DA 44E2 7BA0 F4D3 DBDB 3974 70D1 2172
uid Sara Golemon <[email protected]>
pub rsa4096 2020-05-09 [SC] [expires: 2024-05-08]
BFDD D286 4282 4F81 18EF 7790 9B67 A5C1 2229 118F
uid [ultimate] Gabriel Caruso (Release Manager) <[email protected]>
sub rsa4096 2020-05-09 [E] [expires: 2024-05-08]
sec rsa4096 2019-06-11 [SC] [expires: 2029-06-08]
5A52880781F755608BF815FC910DEB46F53EA312
uid [ultimate] Derick Rethans <[email protected]>
uid [ultimate] Derick Rethans <[email protected]>
uid [ultimate] Derick Rethans (GitHub) <[email protected]>
uid [ultimate] Derick Rethans (PHP) <[email protected]>
ssb rsa4096 2019-06-11 [E] [expires: 2029-06-08]
pub rsa4096 2019-05-29 [SC] [expires: 2021-05-28]
4267 0A7F E4D0 441C 8E46 3234 9E4F DC07 4A4E F02D
uid [ultimate] Peter Kokot <[email protected]>
sub rsa4096 2019-05-29 [E] [expires: 2021-05-28]
pub rsa4096/118BCCB6 2018-06-05 [SC] [expires: 2022-06-04]
Key fingerprint = CBAF 69F1 73A0 FEA4 B537 F470 D66C 9593 118B CCB6
uid Christoph M. Becker <[email protected]>
pub 2048D/5DA04B5D 2012-03-19
Key fingerprint = F382 5282 6ACD 957E F380 D39F 2F79 56BC 5DA0 4B5D
uid Stanislav Malyshev (PHP key) <[email protected]>
uid Stanislav Malyshev (PHP key) <[email protected]>
uid Stanislav Malyshev (PHP key) <[email protected]>
A full list of GPG keys used for current and older releases is also available.