Use the voidlinux wiki: Verifying release files with GPG