using

ar p <package> debian-binary control.tar.gz data.tar.gz | gpg --verify _gpgorigin -

The signature matches with the osquery one, the only difference seems to be the date

Thanks for checking! I’ll try to remove the freight cache and rebuild the Package manifest using the package that’s on the downloads page.