[deleted] Awesome, thanks!
I got this far, then ...
$ ssh-keygen -Y verify -f allowed_signers -I contact@grapheneos.org -n "factory images" -s DEVICE_NAME-factory-VERSION.zip.sig < DEVICE_NAME-factory-VERSION.zip
Couldn't parse signature: missing header
sig_verify: sshsig_armor: invalid format
Could not verify signature.