This signature file may be used to cryptographically verify file integrity, like this:: $ gpg --keyserver hkp://keyserver.ubuntu.com --recv-keys 0xA16EB94D $ gpg --list-keys 0xA16EB94D pub 2048R/A16EB94D 2008-08-15 [expires: 2023-08-12] uid Turnkey Linux Release Key $ gpg --verify turnkey-trac-13.0-wheezy-amd64-vmdk.zip.sig gpg: Signature made Wed Oct 16 10:27:44 UTC 2013 using RSA key ID A16EB94D gpg: Good signature from "Turnkey Linux Release Key" For your convenience we also include file checksums: * sha1sum cfebe5690132bdb338177bce2ef8c94780442dcf * md5sum 9a93b56fbee350fbb92d96acbb900eab You can calculate these on your end and compare to check for errors, but cryptographic verification is recommended for security reasons. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) iQEcBAABAgAGBQJSXmoXAAoJEIXCXpWhbrlNklgIAKN4XdPoIZPOJg7mWXHL0pXl 4wOuFSOPbych73rjbw26p+g2DUOLCmniYbpLPCDNe8t1kZ9V3kRTNSx8wGOwPmcu pYQOS5oc7rdrSZVhAddM5V4YYD+96SDIByJ3qahcHnaMMTx/y/r7VzxN9yeWr2t8 54xBGcimSYV6rZ8akev77gPV9d3XAXDJg9rCNAYEP+yJEWb80UIHw7N/q/XoQAW7 OBVZYVlQCGtphD9Gw0v9JwHLPAaVszEhPnlVK6v4C2mzCsKfuijZqUJeQu+38BPj Z0zTQuwPaTwAE+Mu3oLsizbUuCIwZFQZ7JoIJ3ZpRJtZZ+EVjHt+Sm2B7WwciYo= =q9H6 -----END PGP SIGNATURE-----