Use the original verification guide
Download the published guide, checksum manifest, detached signatures and release-authority public key. Establish the key fingerprint through a trust path appropriate to your use. Downloading a key beside a file does not independently authenticate the key owner.
The release index lists 20 approved publication assets. Its checksum manifest covers the other 18 approved assets, excluding the manifest and its own signature. Preserve those scopes rather than treating every file in a directory as the release.
Check the canonical package and signed records
The canonical Witnessability_Core_1.0_RC2_Ratification_Package_Final.zip is 237677 bytes with SHA-256 9ab6071ee53354dacf9ad7377d5a3fc75dc6a4d310a131ca2335703d35a1b541. It contains 53 regular files: 52 are covered by the internal checksum manifest; the manifest itself is the 53rd file.
The signed release index, License Grant Record and ratification attestation retain their original bytes and separate verification roles. Consult the complete release record and original external verification guide for their scopes and qualifications.
Interpret the check narrowly
A matching digest relates bytes to a stated baseline. A valid signature relates a signed artifact to a key under the signature scheme and trust assumptions. Neither check establishes that every proposition in the conceptual document is true or independently validated.