The releases are tagged and signed in the PHP Git Repository. The follwing official GnuPG keys of the current PHP Release Manager can be used to verify the tags:
pub 2048D/5DA04B5D 2012-03-19
Key fingerprint = F382 5282 6ACD 957E F380 D39F 2F79 56BC 5DA0 4B5D
uid Stanislav Malyshev (PHP key) <smalyshev@gmail.com>
uid Stanislav Malyshev (PHP key) <stas@php.net>
uid Stanislav Malyshev (PHP key) <smalyshev@sugarcrm.com>
pub 4096R/7267B52D 2012-03-20 [expires: 2016-03-19]
Key fingerprint = 0B96 609E 270F 565C 1329 2B24 C13C 70B8 7267 B52D
uid David Soria Parra <dsp@php.net>
pub 2048R/FC9C83D7 2012-03-18 [expires: 2017-03-17]
Key fingerprint = 0A95 E9A0 2654 2D53 835E 3F3A 7DEC 4E69 FC9C 83D7
uid Johannes Schlüter <johannes@schlueters.de>
uid Johannes Schlüter <johannes@php.net>