The source project of this merge request has been removed.
Verify signature of the ISO
Download the matching signature from archlinux.org and use pacman-key to verify it.
The signature must not be downloaded from the mirrors for safety reasons and the use of pacman-key avoids messing with the user's GPG keyring. See https://wiki.archlinux.org/title/Installation_guide#Verify_signature.