&quot;If you&#x27;re downloading the signature each time you&#x27;re downloading a new version of a package or iso, and its SHAs, you&#x27;re using GPG incorrectly.&quot;<p>I believe you&#x27;re confusing a PGP public key with a PGP signature for a particular file (made using said public key).