Download verification

$gpg = (Get-Command gpg.exe -ErrorAction Stop).Source
$publicKey = (Resolve-Path -LiteralPath '.\webbi-networks-vaultkind.asc').Path
$fingerprint = '0012D24994ABFAD13986A366CDA480EEB7B5EE3B'
$verifyHome = Join-Path $env:TEMP ('vaultkind-public-verify-' + [guid]::NewGuid().ToString('N'))
New-Item -ItemType Directory -Path $verifyHome -ErrorAction Stop | Out-Null
$publicOptions = @('--no-options', '--homedir', $verifyHome, '--batch',
    '--no-auto-key-retrieve', '--auto-key-locate', 'clear')
$keyRecords = @(& $gpg @publicOptions --with-colons --fingerprint --show-keys $publicKey)
if ($LASTEXITCODE -ne 0) { throw 'Public-key inspection failed.' }
$primaryRecords = @($keyRecords | Where-Object { $_.StartsWith('pub:') })
$otherKeys = @($keyRecords | Where-Object { $_ -match '^(sec|ssb|sub):' })
$fingerprintRecords = @($keyRecords | Where-Object { $_.StartsWith('fpr:') })
if ($primaryRecords.Count -ne 1 -or $otherKeys.Count -ne 0 -or $fingerprintRecords.Count -ne 1) {
    throw 'Expected exactly one public primary key with no subkeys or secret keys.'
}
$exportedFingerprint = $fingerprintRecords[0].Split(':')[9]
if ($exportedFingerprint -cne $fingerprint) { throw 'Public-key fingerprint mismatch.' }
& $gpg @publicOptions --import $publicKey
if ($LASTEXITCODE -ne 0) { throw 'Public-key import failed.' }
Write-Output "Public key fingerprint matches: $fingerprint"

Continue only if the final line reports the exact expected fingerprint. If gpg.exe is not found, open a new PowerShell window after installation or set $gpg to the installed executable's full path.

Download press-kit.zip and press-kit.zip.asc into the same folder as the public key. Run these commands in the same PowerShell session after step 1 succeeds.

$inputFile = (Resolve-Path -LiteralPath '.\press-kit.zip').Path
$signature = (Resolve-Path -LiteralPath '.\press-kit.zip.asc').Path
$verification = @(& $gpg @publicOptions --status-fd 1 --verify $signature $inputFile)
if ($LASTEXITCODE -ne 0) { throw 'Signature verification failed.' }
$validSignatures = @($verification | Where-Object { $_ -match '^\[GNUPG:\] VALIDSIG ' })
$invalidStatus = @($verification | Where-Object {
    $_ -match '^\[GNUPG:\] (BADSIG|ERRSIG|EXPSIG|EXPKEYSIG|REVKEYSIG|FAILURE|ERROR) '
})
if ($invalidStatus.Count -ne 0 -or $validSignatures.Count -ne 1 -or
    ($validSignatures[0] -split ' ')[2] -cne $fingerprint) {
    throw 'Verification did not establish the expected primary signer.'
}
Write-Output "Verified exact file and signer: $fingerprint"

A successful result ends with Verified exact file and signer: 0012D24994ABFAD13986A366CDA480EEB7B5EE3B. Keep the ZIP and signature together; extracting or rebuilding the ZIP produces different bytes.