With files SHA512SUMS and SHA512SUMS.sign in the current directory the verifying can be as simple as

    gpg --auto-key-retrieve SHA512SUMS.sign

The key is retrieved from user's default keyring or keyservers. The usual keyserver pool (pool.sks-keyservers.net) has the Debian CD signing key. How we can trust that the key is the right one is another matter. It is signed by many Debian developers.

Right, if you're already in the WOT then there are better ways, but then you're probably familiar enough with GPG that you don't need any help. :-)

Most distributions have signed checksum files, but also post those checksums in a HTTPS location. I, and I suspect most people, just check against that and call it good. AFAIK Debian don't have that, and between using GPG or thinking "F* it, I'll take my chances", I suspect many would choose the latter. I was trying to give people who's security conscious but not paranoid^W^Wlazy an option.

Sadly, the verification procedure is so complicated, most people won't bother, and most of the remaining people will do it wrong.

It's not working for me..

# gpg --keyserver keyring.debian.org --recv-keys EF0F382A1A7B6500 gpg: requesting key 1A7B6500 from hkp server keyring.debian.org gpgkeys: key EF0F382A1A7B6500 can't be retrieved gpg: no valid OpenPGP data found.

Where are you getting "EF0F382A1A7B6500" from? The short key ids on the page, at least for me, are:

64E6EA7D

6294BE9B

09EA8AC3

# apt-get update ......... Reading package lists... Done W: There is no public key available for the following key IDs: EF0F382A1A7B6500

apt-get install debian-archive-keyring seems to do the trick

See Debian Bug #860831.