Update. Not sure yet what to do with CodeDownloadFiles.iss. Keep ISSigKeys out of it? Or keep archive extraction out of it? Or revert back to just one example now that the archive extraction is so simple?

Examples/CodeDownloadFiles2.iss

@@ -15,21 +15,21 @@ OutputDir=userdocs:Inno Setup Examples Output
 ArchiveExtraction=enhanced/nopassword
 
 [ISSigKeys]
-Name: "mykey"; \
+Name: "mykey"; RuntimeID: "def02"; \
   KeyID:   "def020edee3c4835fd54d85eff8b66d4d899b22a777353ca4a114b652e5e7a28"; \
   PublicX: "515dc7d6c16d4a46272ceb3d158c5630a96466ab4d948e72c2029d737c823097"; \
   PublicY: "f3c21f6b5156c52a35f6f28016ee3e31a3ded60c325b81fb7b1f88c221081a61"
 
 [Files]
 ; Place any regular files here
-Source: "MyProg.exe"; DestDir: "{app}";
-Source: "MyProg.chm"; DestDir: "{app}";
-Source: "Readme.txt"; DestDir: "{app}"; Flags: isreadme;
-; These files will be downloaded
+Source: "MyProg.exe"; DestDir: "{app}"
+Source: "MyProg.chm"; DestDir: "{app}"
+Source: "Readme.txt"; DestDir: "{app}"; Flags: isreadme
+; These files will be downloaded. If you include flag issigverify here the file will be verified
+; a second time while copying. Verification while copying is efficient, except for archives.
 Source: "{tmp}\innosetup-latest.exe"; DestDir: "{app}"; Flags: external ignoreversion issigverify
+Source: "{tmp}\MyProg-ExtraReadmes.7z"; DestDir: "{app}"; Flags: external extractarchive recursesubdirs ignoreversion
 Source: "{tmp}\ISCrypt.dll"; DestDir: "{app}"; Flags: external ignoreversion
-; Note that each file in the MyProg-ExtraReadmes.7z example archive comes with an .issig signature file
-Source: "{tmp}\MyProg-ExtraReadmes\MyProg-ExtraReadmes.7z"; Excludes: "*.issig"; DestDir: "{app}"; Flags: external extractarchive recursesubdirs ignoreversion issigverify
 
 [Icons]
 Name: "{group}\My Program"; Filename: "{app}\MyProg.exe"
@@ -37,22 +37,41 @@ Name: "{group}\My Program"; Filename: "{app}\MyProg.exe"
 [Code]
 var
   DownloadPage: TDownloadWizardPage;
+  AllowedKeysRuntimeIDs: TStringList;
 
 procedure InitializeWizard;
 begin
   DownloadPage := CreateDownloadPage(SetupMessage(msgWizardPreparing), SetupMessage(msgPreparingDesc), nil);
   DownloadPage.ShowBaseNameInsteadOfUrl := True;
+  
+  // To allow all keys you can also just pass nil instead of this list to AddWithISSigVerify 
+  AllowedKeysRuntimeIDs := TStringList.Create;
+  AllowedKeysRuntimeIDs.Add('def02');
+end;
+
+procedure DeinitializeSetup;
+begin
+  if AllowedKeysRuntimeIDs <> nil then
+    AllowedKeysRuntimeIDs.Free;
 end;
 
 function NextButtonClick(CurPageID: Integer): Boolean;
 begin
   if CurPageID = wpReady then begin
     DownloadPage.Clear;
-    // Use AddEx to specify a username and password
-    DownloadPage.Add('https://jrsoftware.org/download.php/is.exe?dontcount=1', 'innosetup-latest.exe', '');
-    DownloadPage.Add('https://jrsoftware.org/download.php/is.exe.issig?dontcount=1', 'innosetup-latest.exe.issig', '');
-    DownloadPage.Add('https://jrsoftware.org/download.php/iscrypt.dll?dontcount=1', 'ISCrypt.dll', '2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc');
-    DownloadPage.Add('https://jrsoftware.org/download.php/myprog-extrareadmes.7z?dontcount=1', 'MyProg-ExtraReadmes.7z', '');
+    // Use AddEx or AddExWithISSigVerify to specify a username and password
+    DownloadPage.AddWithISSigVerify(
+      'https://jrsoftware.org/download.php/is.exe?dontcount=1',
+      'https://jrsoftware.org/download.php/is.exe.issig',
+      'innosetup-latest.exe', AllowedKeysRuntimeIDs);
+    DownloadPage.AddWithISSigVerify(
+      'https://jrsoftware.org/download.php/myprog-extrareadmes.7z',
+      'https://jrsoftware.org/download.php/myprog-extrareadmes.7z.issig',
+      'MyProg-ExtraReadmes.7z', AllowedKeysRuntimeIDs);
+    DownloadPage.Add(
+      'https://jrsoftware.org/download.php/iscrypt.dll?dontcount=1',
+      'ISCrypt.dll',
+      '2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc');
     DownloadPage.Show;
     try
       try