gpg(1) --verify php.tar.xz.asc
OpenPGP encryption and signing tool
--verify
       Assume  that  the  first  argument  is a signed file or a detached signature and verify it without
       generating any output. With no arguments, the signature packet is  read  from  STDIN.  If  only  a
       sigfile is given, it may be a complete signature or a detached signature, in which case the signed
       stuff is expected in a file without the ".sig" or ".asc" extension.  With more  than  1  argument,
       the first should be a detached signature and the remaining files are the signed stuff. To read the
       signed stuff from STDIN, use '-'' as  the  second  filename.   For  security  reasons  a  detached
       signature cannot read the signed material from STDIN without denoting it in the above way.
source manpages: gpg