Hi,
you’ve asked the same question in the DE forum and the gpg4win-users-de mailinglist.
Let us discuss it there .
(The very brief answer is: Build a trust chain. And see https://wiki.manjaro.org/index.php?title=How-to_verify_GPG_key_of_official_.ISO_images how to download the Manjaro pubkey, just use the browser.)
Regards,
Bernhard