sha256sums-unsigned-build.incrementals.txt and sha256sums-unsigned-build.txt are not signed with torbrowser key
It seems https://dist.torproject.org/torbrowser/11.0.3/sha256sums-unsigned-build.txt.asc and https://dist.torproject.org/torbrowser/11.0.3/sha256sums-unsigned-build.incrementals.txt.asc are the signatures from GeKo (so they should be renamed to .asc-gk), instead of the signatures from the torbrowser key.