Anyone got an AppVM or Debian standalone solution for Mullvad VPN?

you cannot just verify the file with gpg commands because the signature
is not of the entire .rpm file. Instead, the signature is only associated
with the critical portions of the package.

Use the right tool:

rpm --import KEY
rpm -K PACKAGE

The output should show SIGNATURES OK

Alternatively, rpm -qi PACKAGE will show the key used to sign the
package.
On the Signature line you should see Key ID fdd1b8244731b36c for my
packages, as explained here

I never presume to speak for the Qubes team. When I comment in the Forum I speak for myself.