Go to the Tor Browser Bundle download [page.][1] Select the correct download, and download! Below the nice, purple button should be a link that says sig. Don't left click but instead right click it. Then select Save Link As in the context menu. (In Firefox, I don't know in the rest, sorry. In Safari I believe you Alt click the link.)

Once downloaded verify as normal. From [Tor Project Docs][1] (It contains instructions for Mac and Linux as well.)

> You need to have GnuPG installed before you can verify signatures.
> Download it from http://gpg4win.org/download.html.
> 
> Once it's installed, use GnuPG to import the key that signed your
> package. Since GnuPG for Windows is a command-line tool, you will need
> to use cmd.exe. Unless you edit your PATH environment variable, you
> will need to tell Windows the full path to the GnuPG program. If you
> installed GnuPG with the default values, the path should be something
> like this: C:\Program Files\Gnu\GnuPg\gpg.exe.
> 
> Erinn Clark signs the Tor Browser Bundles. Import her key
> (0x416F061063FEE659) by starting cmd.exe and typing:
> 
> "C:\Program Files\Gnu\GnuPg\gpg.exe" --keyserver
> x-hkp://pool.sks-keyservers.net --recv-keys 0x416F061063FEE659
> 
> After importing the key, you can verify that the fingerprint is
> correct:
> 
> "C:\Program Files\Gnu\GnuPg\gpg.exe" --fingerprint 0x416F061063FEE659
> 
> You should see:
> 
>     pub   2048R/63FEE659 2003-10-16
>           Key fingerprint = 8738 A680 B84B 3031 A630  F2DB 416F 0610 63FE E659
>     uid                  Erinn Clark <[email protected]>
>     uid                  Erinn Clark <[email protected]>
>     uid                  Erinn Clark <[email protected]>
>     sub   2048R/EB399FD7 2003-10-16
> 
> To verify the signature of the package you downloaded, you will need
> to download the ".asc" file as well. Assuming you downloaded the
> package and its signature to your Desktop, run:
> 
> "C:\Program Files\Gnu\GnuPg\gpg.exe" --verify
> C:\Users\Alice\Desktop\tor-browser-2.3.25-13_en-US.exe.asc
> C:\Users\Alice\Desktop\tor-browser-2.3.25-13_en-US.exe
> 
> The output should say "Good signature":
> 
>     gpg: Signature made Wed 31 Aug 2011 06:37:01 PM EDT using RSA key ID 63FEE659
>     gpg: Good signature from "Erinn Clark <[email protected]>"
>     gpg:                 aka "Erinn Clark <[email protected]>"
>     gpg:                 aka "Erinn Clark <[email protected]>"
>     gpg: WARNING: This key is not certified with a trusted signature!
>     gpg:          There is no indication that the signature belongs to the owner.
>     Primary key fingerprint: 8738 A680 B84B 3031 A630  F2DB 416F 0610 63FE E659
>     
> 
> Notice that there is a warning because you haven't assigned a trust
> index to this person. This means that GnuPG verified that the key made
> that signature, but it's up to you to decide if that key really
> belongs to the developer. The best method is to meet the developer in
> person and exchange key fingerprints.

Then install as normal by running the `.exe`, should be `torbrowser-install-X.Y.Z_LANGUAGE.exe` in my case `torbrowser-install-3.6.2_en-US.exe`.

 


  [1]: https://www.torproject.org/docs/verifying-signatures.html.en