The releases are tagged and signed in the PHP Git Repository. The following official GnuPG keys of the current PHP Release Manager can be used to verify the tags:
pub 4096R/70D12172 2017-04-14 [expires: 2024-04-21] Key fingerprint = 1729 F839 38DA 44E2 7BA0 F4D3 DBDB 3974 70D1 2172 uid Sara Golemon <pollita@php.net> pub 4096R/EE5AF27F 2017-05-24 [expires: 2024-05-22] Key fingerprint = B1B4 4D8F 021E 4E2D 6021 E995 DC9F F8D3 EE5A F27F uid Remi Collet <remi@php.net>
pub 4096R/7BD5DCD0 2016-05-07 Key fingerprint = A917 B1EC DA84 AEC2 B568 FED6 F50A BC80 7BD5 DCD0 uid Davey Shafik <davey@php.net> pub 2048R/31CBD89E 2016-12-08 Key fingerprint = 5289 95BF EDFB A719 1D46 839E F9BA 0ADA 31CB D89E uid Joe Watkins <krakjoe@php.net>
pub 2048R/9C0D5763 2015-06-09 [expires: 2024-06-06] Key fingerprint = 1A4E 8B72 77C4 2E53 DBA9 C7B9 BCAA 30EA 9C0D 5763 uid Anatol Belski <ab@php.net> pub 2048R/33CFC8B3 2014-01-14 [expires: 2020-01-13] Key fingerprint = 6E4F 6AB3 21FD C07F 2C33 2E3A C2BF 0BC4 33CF C8B3 uid Ferenc Kovacs <tyrael@php.net>
pub 2048R/33CFC8B3 2014-01-14 [expires: 2020-01-13] Key fingerprint = 6E4F 6AB3 21FD C07F 2C33 2E3A C2BF 0BC4 33CF C8B3 uid Ferenc Kovacs <tyrael@php.net> pub 2048R/90D90EC1 2013-07-18 [expire : 2016-07-17] Key fingerprint = 0BD7 8B5F 9750 0D45 0838 F95D FE85 7D9A 90D9 0EC1 uid Julien Pauli <jpauli@php.net>
A full list of GPG keys used for current and older releases is also available.