Release check
Two questions, and they are not the same question. Does this file match the published release, and is the published release signed by the KISS key. The first one this page answers. The second one your own computer has to answer, and the reason why is at the bottom.
1. Does the file match
Drop the firmware file for your board here. Each board has its own, and the expected hash for each is at the bottom of this page. It is hashed on this page, in your browser. Nothing is uploaded, and this works with no network at all.
2. Is the release signed
One command, in a terminal, in the folder you downloaded:
It must say Good signature and show this fingerprint:
Check that fingerprint against a second source before you trust it. The repository, the release notes, and anywhere else the project publishes it. A key you only ever saw next to the file it signs proves nothing.
Why the signature is not checked here
Because this page came from the same place as the file. A page that checked its own download would be vouching for itself, and anyone who could replace the firmware could replace the page that approves it. The hash check above is safe to run here because you compare its answer against a number that is inside the signed manifest.
What this does and does not prove
Does: the binary is exactly what the key holder built, from a commit you can rebuild yourself.
Does not: that the device will only boot signed firmware. That is secure boot, a separate hardware step. A release signature protects the download. Secure boot protects the device.
Expected for 0.1.0-beta11:
Guition 4.3in, kiss-signer-0.1.0-beta11.bin: 0078184abe4021b1dcecbf80b8f2092d866a5ecb8494342e40a441c3f664abeb
Waveshare 3.5in, kiss-signer-0.1.0-beta11-ws35.bin: 7bf8ff09826a71c3ce8fa758aa6d9276d80c1c4df9fbf365300167500c02a2f4
Guition 7in, kiss-signer-0.1.0-beta11-jc1060.bin: e2c4cb72ab4faa5ff3591667abfffff028ea4f211f66330d45e81baa3855ffa5