The releases are tagged and signed in the PHP Git Repository. The following official GnuPG keys of the current PHP Release Manager can be used to verify the tags:
pub   rsa4096/118BCCB6 2018-06-05 [SC] [expires: 2022-06-04]
      Key fingerprint = CBAF 69F1 73A0 FEA4 B537  F470 D66C 9593 118B CCB6
uid                  Christoph M. Becker <cmb@php.net>
pub   2048D/5DA04B5D 2012-03-19
      Key fingerprint = F382 5282 6ACD 957E F380  D39F 2F79 56BC 5DA0 4B5D
uid                  Stanislav Malyshev (PHP key) <smalyshev@gmail.com>
uid                  Stanislav Malyshev (PHP key) <stas@php.net>
uid                  Stanislav Malyshev (PHP key) <smalyshev@sugarcrm.com>      
    
pub   4096R/70D12172 2017-04-14 [expires: 2024-04-21]
      Key fingerprint = 1729 F839 38DA 44E2 7BA0  F4D3 DBDB 3974 70D1 2172
uid                  Sara Golemon <pollita@php.net>
pub   4096R/EE5AF27F 2017-05-24 [expires: 2024-05-22]
      Key fingerprint = B1B4 4D8F 021E 4E2D 6021  E995 DC9F F8D3 EE5A F27F
uid                  Remi Collet <remi@php.net>
pub   rsa4096/118BCCB6 2018-06-05 [SC] [expires: 2022-06-04]
      Key fingerprint = CBAF 69F1 73A0 FEA4 B537  F470 D66C 9593 118B CCB6
uid                  Christoph M. Becker <cmb@php.net>      
    
pub   4096R/7BD5DCD0 2016-05-07
      Key fingerprint = A917 B1EC DA84 AEC2 B568 FED6 F50A BC80 7BD5 DCD0
uid                  Davey Shafik <davey@php.net>
pub   2048R/31CBD89E 2016-12-08
      Key fingerprint = 5289 95BF EDFB A719 1D46  839E F9BA 0ADA 31CB D89E
uid                  Joe Watkins <krakjoe@php.net>
pub   4096R/70D12172 2017-04-14 [expires: 2024-04-21]
      Key fingerprint = 1729 F839 38DA 44E2 7BA0  F4D3 DBDB 3974 70D1 2172
uid                  Sara Golemon <pollita@php.net>
      
    A full list of GPG keys used for current and older releases is also available.
