Don't forget to verify the install medium, which is a little more involved with Debian.
If you're already running a trusted Debian system, then install the debian-keyring package. Packages are signed and verified, so those keys don't need further verification.
Otherwise, fetch the keys in [0] with gpg:
$ gpg --keyserver keyring.debian.org --recv-keys <...> # e.g. 0x6294BE9B
Then, verify the key's fingerprint with [0]:
$ gpg --fingerprint
Unless you don't trust your CA, this is good enough.
Finally download the checksum and their signature files, and verify their signatures:
$ gpg --verify <...> # e.g. SHA512SUMS.sign
$ gpg --no-default-keyring --keyring /usr/share/keyrings/debian-role-keys.gpg --verify <...> # if using debian-keyring package
[0]
https://www.debian.org/CD/verify
If you're already running a trusted Debian system, then install the debian-keyring package. Packages are signed and verified, so those keys don't need further verification.
Otherwise, fetch the keys in [0] with gpg:
Then, verify the key's fingerprint with [0]: Unless you don't trust your CA, this is good enough.Finally download the checksum and their signature files, and verify their signatures:
[0] https://www.debian.org/CD/verify