Validating CachyOS' .sig file (not gpg)
- Install cosign. If it's not in your distro, it's in brew.
- Download CachyOS' cosign public key and save as cosign.pub
- Download the .sig file for the iso. It's the lock icon when you got the iso.
- cosign verify-blob --key cosign.pub iso file --signature .sig file
Apparently --signature has been deprecated but still works for now. The .sig file is not in the correct format for --bundle as far as I can tell.
Thank you, Game_in_Theory.