The openssl public key is required to verify against. This file is also on the mirror directory listing page, however you should not trust the copy there. Download it, open it up, and verify that the public key matches the one from other sources. If it does not, the mirror may have been hacked, or you may be the victim of a Man In The Middle attack. Some other sources to get the public key from include:
* https://pkg.opnsense.org/releases/mirror/README
* https://forum.opnsense.org/index.php?board=11.0
* https://opnsense.org (Scroll down to bottom of page, see "Latest News" for release announcements)
* https://lists.opnsense.org/pipermail/announce/ (also available via mail so your HTTP(S) is not intercepted)
* https://pkg.opnsense.org (/<FreeBSD version & archtecture>/<release version>/sets/changelog.txz) (lands signed and verified in the GUI of the running software)
Note that only the release announcements for major versions contain the public key. I.e. 18.7 would have a copy of the public key in the release announcement, but 18.7.9 would not.
Once you have downloaded all the required files and a copy of the public key, and VERIFIED that the public key matches the public key from the alternate sources listed above, you can be relatively certain that the key has not been tampered with. To verify the downloaded image, run the following commands (substituting the names in brackets for the files you downloaded):
Make sure to change the "iso" to "img" in the second line if you downloaded a different installer type.
If the output of the second command is "Verified OK", your image was verified successfully, and you can install it. If it has any other output, you may have made an error using the commands, or the image may have been compromised.