From Coinkite's official list of releases:

https://raw.githubusercontent.com/Coldcard/firmware/master/releases/signatures.txt

The PGP verification is done by the device itself.