I am currently going through PGP & GPG book. I installed GnuPG Suit a while back but did not verify checksum nor signature. I somehow created a key. Obviously by playing around. I now want to verify that the software is authentic but don't have the dmg file. Should I delete the software and re-download? And if so, do I copy from it my keyring? Thank you.
You can try to export keys from your keyring and save them to a secure place.
As written here, https://gist.github.com/chrisroos/1205934 :
gpg --export-ownertrust > path/to/secure/directory/gpg.txt
And, to import it back, you could :
gpg --import-ownertrust your/ownertrust/gpg.txt