You *have to* verify downloaded tarballs authenticity to be sure that
you retrieved trusted and untampered software.

Metalink4 file contains its OpenSSH signature.
=> PUBKEY-SSH.pub
=> PUBKEY-SSH.pub.asc
=> OpenSSH
=> GnuPG
=> Metalink4

[cm/signed/] .sig file can be verified with:
=> PUBKEY-CM.pub
=> PUBKEY-CM.pub.asc

    $ ln -s PUBKEY-CM.pub $(kekspp -v -p /data/id <PUBKEY-CM.pub)
    $ cat keks-$version.tar.zst.sig keks-$version.tar.zst |
        cmsigtool -v -d -pubs .