The releases are tagged and signed in the PHP Git Repository. The following official GnuPG keys of the current PHP Release Manager can be used to verify the tags:
pub rsa4096 2021-04-01 [SC] 1198 C011 7593 497A 5EC5 C199 286A F1F9 8974 69DC uid [ultimate] Pierrick Charron <pierrick@php.net> sub rsa4096 2021-04-01 [E] pub rsa4096 2016-11-25 [SC] AFD8 691F DAED F03B DF6E 4605 63F1 5A9B 7153 76CA uid [ultimate] Eric A Mann <eric@sixthree.me> uid [ultimate] Eric A Mann <eric@eamann.com> uid [ultimate] Eric A Mann <eric@eam.me> uid [ultimate] Eric Mann <ericmann@php.net> sub rsa4096 2016-11-25 [S] sub rsa4096 2016-11-25 [E] sub rsa4096 2016-11-25 [A] pub ed25519 2021-04-10 [SC] C28D937575603EB4ABB725861C0779DC5C0A9DE4 uid [ultimate] Jakub Zelenka <bukka@php.net> uid [ultimate] Jakub Zelenka <jakub.openssl@gmail.com> uid [ultimate] Jakub Zelenka <jakub.zelenka@gmail.com> sub cv25519 2021-04-10 [E]
pub rsa4096 2021-04-01 [SC] 1198 C011 7593 497A 5EC5 C199 286A F1F9 8974 69DC uid [ultimate] Pierrick Charron <pierrick@php.net> sub rsa4096 2021-04-01 [E] pub rsa4096 2021-04-26 [SC] [expires: 2025-11-24] 39B6 4134 3D8C 104B 2B14 6DC3 F9C3 9DC0 B969 8544 uid [ultimate] Ben Ramsey <ramsey@php.net> sub rsa4096 2021-04-26 [E] [expires: 2025-11-24] pub rsa4096 2021-03-26 [SC] [expires: 2030-03-26] E609 13E4 DF20 9907 D8E3 0D96 659A 97C9 CF2A 795A uid [ultimate] Sergey Panteleev <sergey@php.net> uid [ultimate] Sergey Panteleev <sergey@s-panteleev.ru> uid [ultimate] Sergey Panteleev <sergey@sergeypanteleev.com> sub rsa4096 2021-03-26 [E] [expires: 2025-03-26]
pub 2048R/31CBD89E 2016-12-08 Key fingerprint = 5289 95BF EDFB A719 1D46 839E F9BA 0ADA 31CB D89E uid Joe Watkins <krakjoe@php.net> pub rsa4096 2021-04-26 [SC] [expires: 2025-11-24] 39B6 4134 3D8C 104B 2B14 6DC3 F9C3 9DC0 B969 8544 uid [ultimate] Ben Ramsey <ramsey@php.net> sub rsa4096 2021-04-26 [E] [expires: 2025-11-24] pub rsa4096 2021-04-01 [SC] F1F6 9223 8FBC 1666 E5A5 CCD4 199F 9DFE F6FF BAFD uid [ultimate] Patrick Allaert <patrickallaert@php.net> sub rsa4096 2021-04-01 [E]
A full list of GPG keys used for current and older releases is also available.