Are there GPG-signed OpenBSD ISOs with which I can verify an installation disc?

Question

Are there GPG-signed OpenBSD ISOs that I can download and later verify the downloaded file? Or at least a GPG-signed shasum?

Answer 1

From the OpenBSD FAQ pages:

The OpenBSD project does not digitally sign releases. [...] If the men in black suits are out to get you, they're going to get you.

However, Theo de Raadt (the OpenBSD founder) has announced earlier this year that the project is moving towards signed packages. Hopefully, this will include signing whole release discs.

Answer 2

Open BSD releases are not signed using PGP keys. Instead the project uses a custom built tool called signify to sign releases.

But how do users determine the correct key without something like the PGP web of trust?

On Oct 24th, 2018 I met with 2 OpenBSD devs in person to verify the current release key. The message below was signed by Theo Bühler <tb[AT]openbsd.org> (PGP: 0x582F9C0EAA32139A) and the key you see was also verified visually letter by letter by Reyk Flöter <reyk[AT]openbsd.org> (PGP: 0x1A12678032292F9D).

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

untrusted comment: openbsd 6.4 base public key
RWQq6XmS4eDAcQW4KsT5Ka0KwTQp2JMOP9V/DR4HTVOL5Bc0D7LeuPwA
-----BEGIN PGP SIGNATURE-----

iQIcBAEBCAAGBQJb0IKaAAoJEFgvnA6qMhOan0sP/1WR5fozYWbwHVQDSHKXP5yD
jjDjhW5T2jAFC4MWXJybdmGTkxEz1wYC9k0aen0hzWTz3M/e1Chcb0aVVql4MAjf
mTECSbr3493jXiYBWmhZC7Qce7nmgdR1KmAcvI3jffBetwrDpaUow9TuXy7U2JB2
zJQI0kT1oKNxg911s1R02uNcW5/Wrvx7UoIhqmn0DLvB+u81Y0JOC2R0JMRxVtqi
sX2g3HaZGwgDoPkfT+KeGQXG2OTwzRG2XFEpuX/2qc05z3MG24GnddwX66WlCGb1
o31qUjviPOBJsq6VGSRycGTalsz+1yPCQ5O3s4WRKebAAoG/nozSdQq2h3Pfgkle
ynsPX5yDS5tYbJERhyVBet4qDM+JXse6FXRl3LxOSkEKfi5Ved6LSf6/WbOXCTxO
R3OQqgp0FO30Tp+mRI0qSoYKQswUOox2TGCKlqWnZurNcEnJ64Zzo7hRtDj16vXa
7XUGo1FOfEfQb5RoHHmj6jfAenhOORb5iMyWi/9MQdb6k/Bj7srS3mKEllZoqLzH
4iFq7XaERNnCGQNUDPusmkqPDOsrl4oec82kCBHxFzYfSkwIZgFn5YBgtuj8vG+5
tmLcYQYH3O4ob0GaOws8Jg+CjUvNJGowWyOnxoqzZxpQRldT8yPdd4qyrYtZdsZz
UTghTbNqVsg6QzN9Xr2z
=irX3
-----END PGP SIGNATURE-----

I also verified Theo Bühler's PGP key and ID and we signed each other's keys so that there would be a PGP "Web Of Trust" path to his key.

Once you have the correct key, you can use these instructions to verify an an iso using the signify tool.