Each ISO ships with a detached OpenPGP signature
(.asc) signed by the matching release key.
Examples below use proxmox-ve_9.2-1.iso; substitute
the filename you downloaded.
Release keys are published at enterprise.proxmox.com/debian/ (not on public keyservers). Pick the one matching the ISO's release:
wget https://enterprise.proxmox.com/debian/proxmox-release-trixie.gpg
Display the fetched key's fingerprint and confirm it matches the value listed below before trusting it for any verification step:
gpg --show-keys ./proxmox-release-trixie.gpg
24B30F06ECC1836A4E5EFECBA7BCD1420BFE778E
F4E136C67CDCE41AE6DE6FC81140AF8F639E0C39
GnuPG (gpgv needs no keyring import):
gpgv --keyring ./proxmox-release-trixie.gpg \
proxmox-ve_9.2-1.iso.asc proxmox-ve_9.2-1.iso
Sequoia (sq):
sq verify --signer-file ./proxmox-release-trixie.gpg \
--signature-file proxmox-ve_9.2-1.iso.asc proxmox-ve_9.2-1.iso
The combined SHA256SUMS covers every ISO and
is signed by both release keys
in SHA256SUMS.asc:
gpgv --keyring ./proxmox-release-trixie.gpg \
SHA256SUMS.asc SHA256SUMS && sha256sum -c SHA256SUMS
Clients still pinned to the previous release key (bookworm) can use the standalone signature:
gpgv --keyring ./proxmox-release-bookworm.gpg \
SHA256SUMS.bookworm-key.asc SHA256SUMS