Are there GPG-signed OpenBSD ISOs that I can download and later verify the downloaded file? Or at least a GPG-signed shasum?
From the OpenBSD FAQ pages:
The OpenBSD project does not digitally sign releases. [...] If the men in black suits are out to get you, they're going to get you.
However, Theo de Raadt (the OpenBSD founder) has announced earlier this year that the project is moving towards signed packages. Hopefully, this will include signing whole release discs.
Open BSD releases are not signed using PGP keys. Instead the project uses a custom built tool called signify to sign releases.
But how do users determine the correct key without something like the PGP web of trust?
On Oct 24th, 2018 I met with 2 OpenBSD devs in person to verify the current release key. The message below was signed by Theo Bühler
0x582F9C0EAA32139A) and the key you see was also verified visually letter by letter by Reyk Flöter
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 untrusted comment: openbsd 6.4 base public key RWQq6XmS4eDAcQW4KsT5Ka0KwTQp2JMOP9V/DR4HTVOL5Bc0D7LeuPwA -----BEGIN PGP SIGNATURE----- iQIcBAEBCAAGBQJb0IKaAAoJEFgvnA6qMhOan0sP/1WR5fozYWbwHVQDSHKXP5yD jjDjhW5T2jAFC4MWXJybdmGTkxEz1wYC9k0aen0hzWTz3M/e1Chcb0aVVql4MAjf mTECSbr3493jXiYBWmhZC7Qce7nmgdR1KmAcvI3jffBetwrDpaUow9TuXy7U2JB2 zJQI0kT1oKNxg911s1R02uNcW5/Wrvx7UoIhqmn0DLvB+u81Y0JOC2R0JMRxVtqi sX2g3HaZGwgDoPkfT+KeGQXG2OTwzRG2XFEpuX/2qc05z3MG24GnddwX66WlCGb1 o31qUjviPOBJsq6VGSRycGTalsz+1yPCQ5O3s4WRKebAAoG/nozSdQq2h3Pfgkle ynsPX5yDS5tYbJERhyVBet4qDM+JXse6FXRl3LxOSkEKfi5Ved6LSf6/WbOXCTxO R3OQqgp0FO30Tp+mRI0qSoYKQswUOox2TGCKlqWnZurNcEnJ64Zzo7hRtDj16vXa 7XUGo1FOfEfQb5RoHHmj6jfAenhOORb5iMyWi/9MQdb6k/Bj7srS3mKEllZoqLzH 4iFq7XaERNnCGQNUDPusmkqPDOsrl4oec82kCBHxFzYfSkwIZgFn5YBgtuj8vG+5 tmLcYQYH3O4ob0GaOws8Jg+CjUvNJGowWyOnxoqzZxpQRldT8yPdd4qyrYtZdsZz UTghTbNqVsg6QzN9Xr2z =irX3 -----END PGP SIGNATURE-----
I also verified Theo Bühler's PGP key and ID and we signed each other's keys so that there would be a PGP "Web Of Trust" path to his key.
Once you have the correct key, you can use these instructions to verify an an iso using the