(Deleted my previous message, there's a better way.)

You can do verification with the openssl command. For example, here's how I manually verify Sparkle updates:

sparkleVerify() {
    ARCHIVE="$1"
    DSAPEM="$2"
    SIGB64="$3"
    # echo "Verifying $ARCHIVE signature $SIGB64 with key: $DSAPEM"
    SIGFILE=$(mktemp -t sig)
    echo -n "$SIGB64" | base64 -D > "$SIGFILE"
    openssl dgst -sha1 -binary "$ARCHIVE" | openssl dgst -dss1 -verify "$DSAPEM" -signature "$SIGFILE"
}

If you're curious as to how to actually create the keys and the signatures, look at how Sparkle does it. If you use this method then verification will work with the example I gave above.

Checking PGP signatures in plugins downloaded from Marketplace is covered in #11909

See also details on how WP does it: https://paragonie.com/blog/2019/05/wordpress-5-2-mitigating-supply-chain-attacks-against-33-internet