DOCSP-30766 Verify MongoDB Packages Page (#3384)

* DOCSP-30766 Verify MongoDB Packages Page

* JA feedback

* external feedback

Author: ajhuh-mdb

source/tutorial/verify-mongodb-packages.txt

@@ -13,3 +13,40 @@ Verify Integrity of MongoDB Packages
 .. |arrow| unicode:: U+27A4
 
 .. include:: includes/rc-available.rst
+
+The MongoDB release team digitally signs all software packages to
+certify that a particular MongoDB package is a valid and unaltered
+MongoDB release. Before installing MongoDB, you should validate the 
+package using either the provided PGP signature or SHA-256 checksum.
+
+PGP signatures provide the strongest guarantees by checking both the
+authenticity and integrity of a file to prevent tampering.
+
+Cryptographic checksums only validate file integrity to prevent network
+transmission errors.
+
+Verify Linux/macOS Packages
+---------------------------
+
+Use PGP/GPG
+~~~~~~~~~~~
+
+MongoDB signs each release branch with a different PGP key. The public 
+key files for each release branch since MongoDB 2.2 are available for
+download from the `key server <https://pgp.mongodb.com/>`_ 
+in both textual ``.asc`` and binary ``.pub`` formats.
+
+.. include:: /includes/steps/install-verify-files-pgp.rst
+
+Use SHA-256
+~~~~~~~~~~~
+
+.. include:: /includes/steps/install-verify-files-sha.rst
+
+Verify Windows Packages
+-----------------------
+
+The following procedure verifies the MongoDB binary against its SHA256 key.
+
+.. include:: /includes/steps/install-verify-files-windows.rst
+