To verify the manifest timestamp from the archive root:
openssl ts -verify -data MANIFEST.json -in timestamp/manifest.tsr -CAfile timestamp/cacert.pem -untrusted timestamp/tsa.crt

Then check each listed file with python3 verify.py or shasum -a 256 -c SHA256SUMS.