The releases are tagged and signed in the PHP Git Repository. The following official GnuPG keys of the current PHP Release Manager can be used to verify the tags:
pub 2048R/31CBD89E 2016-12-08 Key fingerprint = 5289 95BF EDFB A719 1D46 839E F9BA 0ADA 31CB D89E uid Joe Watkins <krakjoe@php.net> pub rsa4096 2021-04-26 [SC] [expires: 2024-11-26] 39B6 4134 3D8C 104B 2B14 6DC3 F9C3 9DC0 B969 8544 uid [ultimate] Ben Ramsey <ramsey@php.net> sub rsa4096 2021-04-26 [E] [expires: 2024-11-26] pub rsa4096 2021-04-01 [SC] F1F6 9223 8FBC 1666 E5A5 CCD4 199F 9DFE F6FF BAFD uid [ultimate] Patrick Allaert <patrickallaert@php.net> sub rsa4096 2021-04-01 [E]
pub 4096R/70D12172 2017-04-14 [expires: 2024-04-21] Key fingerprint = 1729 F839 38DA 44E2 7BA0 F4D3 DBDB 3974 70D1 2172 uid Sara Golemon <pollita@php.net> pub rsa4096 2020-05-09 [SC] [expires: 2024-05-08] BFDD D286 4282 4F81 18EF 7790 9B67 A5C1 2229 118F uid [ultimate] Gabriel Caruso (Release Manager) <carusogabriel@php.net> sub rsa4096 2020-05-09 [E] [expires: 2024-05-08]
sec rsa4096 2019-06-11 [SC] [expires: 2029-06-08] 5A52880781F755608BF815FC910DEB46F53EA312 uid [ultimate] Derick Rethans <gpg@derickrethans.nl> uid [ultimate] Derick Rethans <derick@derickrethans.nl> uid [ultimate] Derick Rethans (GitHub) <github@derickrethans.nl> uid [ultimate] Derick Rethans (PHP) <derick@php.net> ssb rsa4096 2019-06-11 [E] [expires: 2029-06-08] pub rsa4096 2019-05-29 [SC] [expires: 2021-05-28] 4267 0A7F E4D0 441C 8E46 3234 9E4F DC07 4A4E F02D uid [ultimate] Peter Kokot <petk@php.net> sub rsa4096 2019-05-29 [E] [expires: 2021-05-28]
A full list of GPG keys used for current and older releases is also available.