Release tarballs are signed with Ryan S. Elliott's <relliott@umn.edu> public
key
(https://z.umn.edu/relliott_asc
[576D4997C4D51D92]).
To verify a release tarball, first download the public key and import it:
$ gpg --import relliott.asc
After downloading the tarball and signature, run:
$ gpg --verify kim-api-X.Y.Z.txz.asc kim-api-X.Y.Z.txz
where X.Y.Z should be replaced with the actual version of interest.