The releases are tagged and signed in the PHP Git Repository. The following official GnuPG keys of the current PHP Release Manager can be used to verify the tags:
pub 4096R/70D12172 2017-04-14 [expires: 2024-04-21] Key fingerprint = 1729 F839 38DA 44E2 7BA0 F4D3 DBDB 3974 70D1 2172 uid Sara Golemon <pollita@php.net> pub rsa4096 2020-05-09 [SC] [expires: 2024-05-08] BFDD D286 4282 4F81 18EF 7790 9B67 A5C1 2229 118F uid [ultimate] Gabriel Caruso (Release Manager) <carusogabriel@php.net> sub rsa4096 2020-05-09 [E] [expires: 2024-05-08]
A full list of GPG keys used for current and older releases is also available.