pacman: invalid or corrupted package (PGP signature)

Every Arch Linux package is signed, and pacman checks the signature against the keys in its keyring. When a package was signed by a key that your keyring does not trust yet, the transaction stops with an error such as:

error: foo: signature from "Jane Packager <jane@archlinux.org>" is unknown trust
:: File /var/cache/pacman/pkg/foo-1.0-1-x86_64.pkg.tar.zst is corrupted (invalid or corrupted package (PGP signature)).
Do you want to delete it? [Y/n]
error: failed to commit transaction (invalid or corrupted package (PGP signature))

Fix: update the keyring first

sudo pacman -Sy archlinux-keyring
sudo pacman -Su

Updating archlinux-keyring alone brings in the new packager keys. Running -Sy without -u is normally discouraged (partial upgrades); here it is followed straight away by the full upgrade.

If keys are still rejected

timedatectl status                     # the clock must be correct
sudo pacman-key --refresh-keys
sudo pacman-key --populate archlinux

As a last resort the Arch wiki describes resetting the whole keyring: remove /etc/pacman.d/gnupg, then run pacman-key --init and pacman-key --populate.