Here's google doc on how to verify signature of a Compass artifact
Server docs: https://www.mongodb.com/docs/manual/tutorial/verify-mongodb-packages/