Get the three files
You need the download, its detached signature, and the publisher's public signing key. This example uses placeholder filenames; replace them with your actual files.
The Monero Love PGP page lists personal and canary keys. A package repository may use a different signing key. Use the key specified by the publisher for that particular download.
Check the fingerprint
With GnuPG installed, inspect the public key:
gpg --show-keys --with-fingerprint publisher.asc
Compare the entire fingerprint with a trusted source you obtained independently. Matching only an email address or a short key ID is insufficient.
Import and verify
gpg --import publisher.asc
gpg --verify download.tar.xz.asc download.tar.xz
Specify both the signature and data file so there is no ambiguity about what you are checking.
Read the result
A good signature means the file matches a signature from that key. You still need to confirm that the key belongs to the intended publisher. A warning about an uncertified identity is a separate question from whether the signature is cryptographically valid.
Stop if verification fails or the fingerprint is unexpected. Do not install the file until you have resolved the mismatch.
For complete options and return-code behavior, see the GnuPG manual.