I've just downloaded the iso file from https://releases.ubuntu.com/jammy/ and also SHA256SUMS and SHA256SUMS.gpg.
When performing, as described in https://ubuntu.com/tutorials/how-to-verify-ubuntu#1-overview ,
gpg --keyid-format long --verify SHA256SUMS.gpg SHA256SUMS
I get
gpg: Signature made Thu Aug 11 13:07:33 2022 CEST
gpg: using RSA key 843938DF228D22F7B3742BC0D94AA3F0EFE21092
gpg: Good signature from "Ubuntu CD Image Automatic Signing Key (2012)
<cdimage@ubuntu.com>" [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg: There is no indication that the signature belongs to the owner.
Primary key fingerprint: 8439 38DF 228D 22F7 B374 2BC0 D94A A3F0 EFE2 1092
The second good signature is missing.
What does this mean?
Information:
The command
gpg --list-keys --with-fingerprint 0xFBB75451 0xEFE21092
gives
pub rsa4096 2012-05-11 [SC]
8439 38DF 228D 22F7 B374 2BC0 D94A A3F0 EFE2 1092
uid [ unknown] Ubuntu CD Image Automatic Signing Key (2012)
<cdimage@ubuntu.com>
pub dsa1024 2004-12-30 [SC]
C598 6B4F 1257 FFA8 6632 CBA7 4618 1433 FBB7 5451
uid [ unknown] Ubuntu CD Image Automatic Signing Key <cdimage@ubuntu.com>