Starting in April 2012, PHP release tags have been signed in Git by the release managers for each branch. The following GnuPG keys can be used to verify these tags:
pub rsa4096 2016-11-25 [SC]
AFD8 691F DAED F03B DF6E 4605 63F1 5A9B 7153 76CA
uid [ultimate] Eric A Mann <eric@sixthree.me>
uid [ultimate] Eric A Mann <eric@eamann.com>
uid [ultimate] Eric A Mann <eric@eam.me>
uid [ultimate] Eric Mann <ericmann@php.net>
sub rsa4096 2016-11-25 [S]
sub rsa4096 2016-11-25 [E]
sub rsa4096 2016-11-25 [A]
pub ed25519 2024-04-17 [SC]
9D7F 99A0 CB8F 05C8 A695 8D62 56A9 7AF7 600A 39A6
uid [ultimate] Calvin Buckley (PHP) <calvinb@php.net>
sub cv25519 2024-04-17 [E]
pub rsa4096 2024-05-20 [SC]
0616 E93D 95AF 4712 43E2 6761 7704 26E1 7EBB B3DD
uid [ultimate] Saki Takamachi (for php.net) <saki@php.net>
sub rsa4096 2024-05-20 [E]
pub rsa4096 2021-04-01 [SC]
1198 C011 7593 497A 5EC5 C199 286A F1F9 8974 69DC
uid [ultimate] Pierrick Charron <pierrick@php.net>
sub rsa4096 2021-04-01 [E]
pub rsa4096 2016-11-25 [SC]
AFD8 691F DAED F03B DF6E 4605 63F1 5A9B 7153 76CA
uid [ultimate] Eric A Mann <eric@sixthree.me>
uid [ultimate] Eric A Mann <eric@eamann.com>
uid [ultimate] Eric A Mann <eric@eam.me>
uid [ultimate] Eric Mann <ericmann@php.net>
sub rsa4096 2016-11-25 [S]
sub rsa4096 2016-11-25 [E]
sub rsa4096 2016-11-25 [A]
pub ed25519 2021-04-10 [SC]
C28D937575603EB4ABB725861C0779DC5C0A9DE4
uid [ultimate] Jakub Zelenka <bukka@php.net>
uid [ultimate] Jakub Zelenka <jakub.openssl@gmail.com>
uid [ultimate] Jakub Zelenka <jakub.zelenka@gmail.com>
sub cv25519 2021-04-10 [E]
pub rsa4096 2021-04-01 [SC]
1198 C011 7593 497A 5EC5 C199 286A F1F9 8974 69DC
uid [ultimate] Pierrick Charron <pierrick@php.net>
sub rsa4096 2021-04-01 [E]
pub rsa4096 2021-04-26 [SC] [expires: 2025-11-24]
39B6 4134 3D8C 104B 2B14 6DC3 F9C3 9DC0 B969 8544
uid [ultimate] Ben Ramsey <ramsey@php.net>
sub rsa4096 2021-04-26 [E] [expires: 2025-11-24]
pub rsa4096 2021-03-26 [SC] [expires: 2030-03-26]
E609 13E4 DF20 9907 D8E3 0D96 659A 97C9 CF2A 795A
uid [ultimate] Sergey Panteleev <sergey@php.net>
uid [ultimate] Sergey Panteleev <sergey@s-panteleev.ru>
uid [ultimate] Sergey Panteleev <sergey@sergeypanteleev.com>
sub rsa4096 2021-03-26 [E] [expires: 2025-03-26]
pub 2048R/31CBD89E 2016-12-08
Key fingerprint = 5289 95BF EDFB A719 1D46 839E F9BA 0ADA 31CB D89E
uid Joe Watkins <krakjoe@php.net>
pub rsa4096 2021-04-26 [SC] [expires: 2025-11-24]
39B6 4134 3D8C 104B 2B14 6DC3 F9C3 9DC0 B969 8544
uid [ultimate] Ben Ramsey <ramsey@php.net>
sub rsa4096 2021-04-26 [E] [expires: 2025-11-24]
pub rsa4096 2021-04-01 [SC]
F1F6 9223 8FBC 1666 E5A5 CCD4 199F 9DFE F6FF BAFD
uid [ultimate] Patrick Allaert <patrickallaert@php.net>
sub rsa4096 2021-04-01 [E]
pub 4096R/70D12172 2017-04-14 [expires: 2024-04-21]
Key fingerprint = 1729 F839 38DA 44E2 7BA0 F4D3 DBDB 3974 70D1 2172
uid Sara Golemon <pollita@php.net>
pub rsa4096 2020-05-09 [SC] [expires: 2024-05-08]
BFDD D286 4282 4F81 18EF 7790 9B67 A5C1 2229 118F
uid [ultimate] Gabriel Caruso (Release Manager) <carusogabriel@php.net>
sub rsa4096 2020-05-09 [E] [expires: 2024-05-08]
pub rsa4096 2022-08-30 [SC] [expires: 2024-08-29]
2C16 C765 DBE5 4A08 8130 F1BC 4B9B 5F60 0B55 F3B4
uid [ultimate] Gabriel Caruso <carusogabriel@php.net>
sub rsa4096 2022-08-30 [E] [expires: 2024-08-29]
pub rsa4096 2021-04-26 [SC] [expires: 2025-11-24]
39B6 4134 3D8C 104B 2B14 6DC3 F9C3 9DC0 B969 8544
uid [ultimate] Ben Ramsey <ramsey@php.net>
sub rsa4096 2021-04-26 [E] [expires: 2025-11-24]
sec rsa4096 2019-06-11 [SC] [expires: 2029-06-08]
5A52880781F755608BF815FC910DEB46F53EA312
uid [ultimate] Derick Rethans <gpg@derickrethans.nl>
uid [ultimate] Derick Rethans <derick@derickrethans.nl>
uid [ultimate] Derick Rethans (GitHub) <github@derickrethans.nl>
uid [ultimate] Derick Rethans (PHP) <derick@php.net>
ssb rsa4096 2019-06-11 [E] [expires: 2029-06-08]
pub rsa4096 2019-05-29 [SC] [expires: 2021-05-28]
4267 0A7F E4D0 441C 8E46 3234 9E4F DC07 4A4E F02D
uid [ultimate] Peter Kokot <petk@php.net>
sub rsa4096 2019-05-29 [E] [expires: 2021-05-28]
pub rsa4096/118BCCB6 2018-06-05 [SC] [expires: 2022-06-04]
Key fingerprint = CBAF 69F1 73A0 FEA4 B537 F470 D66C 9593 118B CCB6
uid Christoph M. Becker <cmb@php.net>
pub 2048D/5DA04B5D 2012-03-19
Key fingerprint = F382 5282 6ACD 957E F380 D39F 2F79 56BC 5DA0 4B5D
uid Stanislav Malyshev (PHP key) <smalyshev@gmail.com>
uid Stanislav Malyshev (PHP key) <stas@php.net>
uid Stanislav Malyshev (PHP key) <smalyshev@sugarcrm.com>
pub 4096R/70D12172 2017-04-14 [expires: 2024-04-21]
Key fingerprint = 1729 F839 38DA 44E2 7BA0 F4D3 DBDB 3974 70D1 2172
uid Sara Golemon <pollita@php.net>
pub 4096R/EE5AF27F 2017-05-24 [expires: 2024-05-22]
Key fingerprint = B1B4 4D8F 021E 4E2D 6021 E995 DC9F F8D3 EE5A F27F
uid Remi Collet <remi@php.net>
pub rsa4096/118BCCB6 2018-06-05 [SC] [expires: 2022-06-04]
Key fingerprint = CBAF 69F1 73A0 FEA4 B537 F470 D66C 9593 118B CCB6
uid Christoph M. Becker <cmb@php.net>
pub 4096R/7BD5DCD0 2016-05-07
Key fingerprint = A917 B1EC DA84 AEC2 B568 FED6 F50A BC80 7BD5 DCD0
uid Davey Shafik <davey@php.net>
pub 2048R/31CBD89E 2016-12-08
Key fingerprint = 5289 95BF EDFB A719 1D46 839E F9BA 0ADA 31CB D89E
uid Joe Watkins <krakjoe@php.net>
pub 4096R/70D12172 2017-04-14 [expires: 2024-04-21]
Key fingerprint = 1729 F839 38DA 44E2 7BA0 F4D3 DBDB 3974 70D1 2172
uid Sara Golemon <pollita@php.net>
pub 2048R/9C0D5763 2015-06-09 [expires: 2024-06-06]
Key fingerprint = 1A4E 8B72 77C4 2E53 DBA9 C7B9 BCAA 30EA 9C0D 5763
uid Anatol Belski <ab@php.net>
pub 2048R/33CFC8B3 2014-01-14 [expires: 2020-01-13]
Key fingerprint = 6E4F 6AB3 21FD C07F 2C33 2E3A C2BF 0BC4 33CF C8B3
uid Ferenc Kovacs <tyrael@php.net>
pub 2048R/33CFC8B3 2014-01-14 [expires: 2020-01-13]
Key fingerprint = 6E4F 6AB3 21FD C07F 2C33 2E3A C2BF 0BC4 33CF C8B3
uid Ferenc Kovacs <tyrael@php.net>
pub 2048R/90D90EC1 2013-07-18 [expire : 2016-07-17]
Key fingerprint = 0BD7 8B5F 9750 0D45 0838 F95D FE85 7D9A 90D9 0EC1
uid Julien Pauli <jpauli@php.net>
pub 2048R/90D90EC1 2013-07-18 [expire : 2016-07-17]
Key fingerprint = 0BD7 8B5F 9750 0D45 0838 F95D FE85 7D9A 90D9 0EC1
uid Julien Pauli <jpauli@php.net>
pub 4096R/7267B52D 2012-03-20 [expires: 2016-03-19]
Key fingerprint = 0B96 609E 270F 565C 1329 2B24 C13C 70B8 7267 B52D
uid David Soria Parra <dsp@php.net>
pub 2048D/5DA04B5D 2012-03-19
Key fingerprint = F382 5282 6ACD 957E F380 D39F 2F79 56BC 5DA0 4B5D
uid Stanislav Malyshev (PHP key) <smalyshev@gmail.com>
uid Stanislav Malyshev (PHP key) <stas@php.net>
uid Stanislav Malyshev (PHP key) <smalyshev@sugarcrm.com>
pub 2048D/5DA04B5D 2012-03-19
Key fingerprint = F382 5282 6ACD 957E F380 D39F 2F79 56BC 5DA0 4B5D
uid Stanislav Malyshev (PHP key) <smalyshev@gmail.com>
uid Stanislav Malyshev (PHP key) <stas@php.net>
uid Stanislav Malyshev (PHP key) <smalyshev@sugarcrm.com>
pub 4096R/7267B52D 2012-03-20 [expires: 2016-03-19]
Key fingerprint = 0B96 609E 270F 565C 1329 2B24 C13C 70B8 7267 B52D
uid David Soria Parra <dsp@php.net>
pub 2048R/FC9C83D7 2012-03-18 [expires: 2017-03-17]
Key fingerprint = 0A95 E9A0 2654 2D53 835E 3F3A 7DEC 4E69 FC9C 83D7
uid Johannes Schlüter <johannes@schlueters.de>
uid Johannes Schlüter <johannes@php.net>
You can download the keyring with all Release Manager public keys: php-keyring.gpg