Note: This answer is duplicated from StackOverflow.

Check out the Tor Project's signing keys page for more info.

If you followed that tutorial exactly, then you imported a single developer's signing key, but this is not the key used to sign the browser releases.

The output you supplied shows that the actual signing key is EB774491D9FF06E2, which shows up on the Tor PGP keys page.

To properly verify, import the correct signing key:

gpg --keyserver pool.sks-keyservers.net --recv-keys EB774491D9FF06E2

Then you should be able to verify the package's signature using --verify.

Check out the Tor Project's signing keys page for more info.

If you followed that tutorial exactly, then you imported a single developer's signing key, but this is not the key used to sign the browser releases.

The output you supplied shows that the actual signing key is EB774491D9FF06E2, which shows up on the Tor PGP keys page.

To properly verify, import the correct signing key:

gpg --keyserver pool.sks-keyservers.net --recv-keys EB774491D9FF06E2

Then you should be able to verify the package's signature using --verify.