With Heads’s related public key injected in dom0 (gpg --import of such trusted public key) prior of upgrading dom0:
sha256sum $(find /boot/kexec*.txt) | gpg --verify /boot/kexec.sig - && cd /boot && sudo sha256sum -c /boot/kexec_hashes.txt
Example output (with my own key)
[user@dom0 boot]$ sha256sum $(find /boot/kexec*.txt) | gpg --verify /boot/kexec.sig - && cd /boot && sudo sha256sum -c /boot/kexec_hashes.txt
gpg: Signature made Thu 02 Jun 2022 12:44:01 PM EDT
gpg: using RSA key ACF4B7893D4D05C8F18069BAE7B4A71658E36A93
gpg: Good signature from "Insurgo Technologies Libres / Open Technologies <insurgo@riseup.net>" [unknown]
gpg: aka "[jpeg image of size 9521]" [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg: There is no indication that the signature belongs to the owner.
Primary key fingerprint: ACF4 B789 3D4D 05C8 F180 69BA E7B4 A716 58E3 6A93
./initramfs-5.10.112-1.fc32.qubes.x86_64.img: OK
./initramfs-5.10.109-1.fc32.qubes.x86_64.img: OK
./xen-4.14.4.config: OK
./.auditing-0: OK
./config-5.10.112-1.fc32.qubes.x86_64: OK
./System.map-5.10.109-1.fc32.qubes.x86_64: OK
./efi/EFI/qubes/initramfs-5.10.112-1.fc32.qubes.x86_64.img: OK
./efi/EFI/qubes/xen-4.14.4.efi: OK
./efi/EFI/qubes/xen.efi: OK
./efi/EFI/qubes/initramfs-5.10.90-1.fc32.qubes.x86_64.img: OK
./loader/entries/ab22ef20d85a490f8e042b251de691a9-5.10.104-3.fc32.qubes.x86_64.conf: OK
./loader/entries/ab22ef20d85a490f8e042b251de691a9-5.10.112-1.fc32.qubes.x86_64.conf: OK
./loader/entries/ab22ef20d85a490f8e042b251de691a9-5.10.109-1.fc32.qubes.x86_64.conf: OK
./config-5.10.109-1.fc32.qubes.x86_64: OK
./symvers-5.10.104-3.fc32.qubes.x86_64.gz: OK
./vmlinuz-5.10.112-1.fc32.qubes.x86_64: OK
./config-5.10.104-3.fc32.qubes.x86_64: OK
./symvers-5.10.109-1.fc32.qubes.x86_64.gz: OK
./initramfs-5.10.104-3.fc32.qubes.x86_64.img: OK
./vmlinuz-5.10.104-3.fc32.qubes.x86_64: OK
./vmlinuz-5.10.109-1.fc32.qubes.x86_64: OK
./System.map-5.10.104-3.fc32.qubes.x86_64: OK
./symvers-5.10.112-1.fc32.qubes.x86_64.gz: OK
./xen-4.14.4.gz: OK
./System.map-5.10.112-1.fc32.qubes.x86_64: OK
./grub2/grubenv: OK
./grub2/device.map: OK
./grub2/i386-pc/gcry_idea.mod: OK
./grub2/i386-pc/loopback.mod: OK
./grub2/i386-pc/search_fs_file.mod: OK
./grub2/i386-pc/tga.mod: OK
./grub2/i386-pc/gcry_serpent.mod: OK
./grub2/i386-pc/font.mod: OK
./grub2/i386-pc/zfs.mod: OK
./grub2/i386-pc/gcry_rsa.mod: OK
./grub2/i386-pc/f2fs.mod: OK
./grub2/i386-pc/bitmap.mod: OK
./grub2/i386-pc/read.mod: OK
./grub2/i386-pc/affs.mod: OK
./grub2/i386-pc/gcry_rmd160.mod: OK
./grub2/i386-pc/udf.mod: OK
./grub2/i386-pc/acpi.mod: OK
./grub2/i386-pc/lspci.mod: OK
./grub2/i386-pc/at_keyboard.mod: OK
./grub2/i386-pc/lsapm.mod: OK
./grub2/i386-pc/uhci.mod: OK
./grub2/i386-pc/aout.mod: OK
./grub2/i386-pc/usb_keyboard.mod: OK
./grub2/i386-pc/vbe.mod: OK
./grub2/i386-pc/keystatus.mod: OK
./grub2/i386-pc/elf.mod: OK
./grub2/i386-pc/shift_test.mod: OK
./grub2/i386-pc/cbls.mod: OK
./grub2/i386-pc/gcry_tiger.mod: OK
./grub2/i386-pc/part_sun.mod: OK
./grub2/i386-pc/sfs.mod: OK
./grub2/i386-pc/fat.mod: OK
./grub2/i386-pc/div_test.mod: OK
./grub2/i386-pc/help.mod: OK
./grub2/i386-pc/extcmd.mod: OK
./grub2/i386-pc/iso9660.mod: OK
./grub2/i386-pc/part_dvh.mod: OK
./grub2/i386-pc/video_bochs.mod: OK
./grub2/i386-pc/pxechain.mod: OK
./grub2/i386-pc/eval.mod: OK
./grub2/i386-pc/linux.mod: OK
./grub2/i386-pc/minix2_be.mod: OK
./grub2/i386-pc/lsacpi.mod: OK
./grub2/i386-pc/relocator.mod: OK
./grub2/i386-pc/procfs.mod: OK
./grub2/i386-pc/truecrypt.mod: OK
./grub2/i386-pc/pbkdf2_test.mod: OK
./grub2/i386-pc/div.mod: OK
./grub2/i386-pc/archelp.mod: OK
./grub2/i386-pc/hello.mod: OK
./grub2/i386-pc/multiboot2.mod: OK
./grub2/i386-pc/modinfo.sh: OK
./grub2/i386-pc/morse.mod: OK
./grub2/i386-pc/crc64.mod: OK
./grub2/i386-pc/ext2.mod: OK
./grub2/i386-pc/crypto.mod: OK
./grub2/i386-pc/mdraid1x.mod: OK
./grub2/i386-pc/videotest_checksum.mod: OK
./grub2/i386-pc/cbfs.mod: OK
./grub2/i386-pc/cpio_be.mod: OK
./grub2/i386-pc/video_fb.mod: OK
./grub2/i386-pc/cmosdump.mod: OK
./grub2/i386-pc/hfsplus.mod: OK
./grub2/i386-pc/probe.mod: OK
./grub2/i386-pc/newc.mod: OK
./grub2/i386-pc/core.img: OK
./grub2/i386-pc/terminfo.mod: OK
./grub2/i386-pc/ntfs.mod: OK
./grub2/i386-pc/part_amiga.mod: OK
./grub2/i386-pc/btrfs.mod: OK
./grub2/i386-pc/gcry_md5.mod: OK
./grub2/i386-pc/vga.mod: OK
./grub2/i386-pc/memdisk.mod: OK
./grub2/i386-pc/gfxterm.mod: OK
./grub2/i386-pc/gfxmenu.mod: OK
./grub2/i386-pc/gcry_sha1.mod: OK
./grub2/i386-pc/cpio.mod: OK
./grub2/i386-pc/fs.lst: OK
./grub2/i386-pc/gcry_dsa.mod: OK
./grub2/i386-pc/hashsum.mod: OK
./grub2/i386-pc/dm_nv.mod: OK
./grub2/i386-pc/pata.mod: OK
./grub2/i386-pc/boot.mod: OK
./grub2/i386-pc/random.mod: OK
./grub2/i386-pc/tar.mod: OK
./grub2/i386-pc/net.mod: OK
./grub2/i386-pc/gcry_des.mod: OK
./grub2/i386-pc/mdraid09_be.mod: OK
./grub2/i386-pc/mul_test.mod: OK
./grub2/i386-pc/terminal.lst: OK
./grub2/i386-pc/ctz_test.mod: OK
./grub2/i386-pc/xnu.mod: OK
./grub2/i386-pc/hfs.mod: OK
./grub2/i386-pc/zstd.mod: OK
./grub2/i386-pc/file.mod: OK
./grub2/i386-pc/gcry_md4.mod: OK
./grub2/i386-pc/part_plan.mod: OK
./grub2/i386-pc/gcry_cast5.mod: OK
./grub2/i386-pc/lzopio.mod: OK
./grub2/i386-pc/raid6rec.mod: OK
./grub2/i386-pc/gfxterm_menu.mod: OK
./grub2/i386-pc/functional_test.mod: OK
./grub2/i386-pc/play.mod: OK
./grub2/i386-pc/odc.mod: OK
./grub2/i386-pc/terminal.mod: OK
./grub2/i386-pc/exfctest.mod: OK
./grub2/i386-pc/hfspluscomp.mod: OK
./grub2/i386-pc/all_video.mod: OK
./grub2/i386-pc/bsd.mod: OK
./grub2/i386-pc/ntfscomp.mod: OK
./grub2/i386-pc/legacy_password_test.mod: OK
./grub2/i386-pc/memrw.mod: OK
./grub2/i386-pc/usbserial_common.mod: OK
./grub2/i386-pc/ls.mod: OK
./grub2/i386-pc/command.lst: OK
./grub2/i386-pc/ufs2.mod: OK
./grub2/i386-pc/diskfilter.mod: OK
./grub2/i386-pc/gcry_seed.mod: OK
./grub2/i386-pc/adler32.mod: OK
./grub2/i386-pc/msdospart.mod: OK
./grub2/i386-pc/gcry_arcfour.mod: OK
./grub2/i386-pc/minix3.mod: OK
./grub2/i386-pc/hdparm.mod: OK
./grub2/i386-pc/pgp.mod: OK
./grub2/i386-pc/iorw.mod: OK
./grub2/i386-pc/macho.mod: OK
./grub2/i386-pc/offsetio.mod: OK
./grub2/i386-pc/nativedisk.mod: OK
./grub2/i386-pc/bfs.mod: OK
./grub2/i386-pc/legacycfg.mod: OK
./grub2/i386-pc/fshelp.mod: OK
./grub2/i386-pc/raid5rec.mod: OK
./grub2/i386-pc/loadenv.mod: OK
./grub2/i386-pc/pci.mod: OK
./grub2/i386-pc/cs5536.mod: OK
./grub2/i386-pc/squash4.mod: OK
./grub2/i386-pc/usbserial_ftdi.mod: OK
./grub2/i386-pc/jfs.mod: OK
./grub2/i386-pc/usbms.mod: OK
./grub2/i386-pc/bufio.mod: OK
./grub2/i386-pc/minix.mod: OK
./grub2/i386-pc/serial.mod: OK
./grub2/i386-pc/syslinuxcfg.mod: OK
./grub2/i386-pc/minix2.mod: OK
./grub2/i386-pc/usb.mod: OK
./grub2/i386-pc/gcry_rijndael.mod: OK
./grub2/i386-pc/gcry_blowfish.mod: OK
./grub2/i386-pc/cmdline_cat_test.mod: OK
./grub2/i386-pc/xnu_uuid.mod: OK
./grub2/i386-pc/videoinfo.mod: OK
./grub2/i386-pc/tftp.mod: OK
./grub2/i386-pc/part_msdos.mod: OK
./grub2/i386-pc/cbtable.mod: OK
./grub2/i386-pc/part_bsd.mod: OK
./grub2/i386-pc/exfat.mod: OK
./grub2/i386-pc/xzio.mod: OK
./grub2/i386-pc/ohci.mod: OK
./grub2/i386-pc/signature_test.mod: OK
./grub2/i386-pc/video_colors.mod: OK
./grub2/i386-pc/cmostest.mod: OK
./grub2/i386-pc/cbtime.mod: OK
./grub2/i386-pc/freedos.mod: OK
./grub2/i386-pc/biosdisk.mod: OK
./grub2/i386-pc/cmp.mod: OK
./grub2/i386-pc/part_dfly.mod: OK
./grub2/i386-pc/gfxterm_background.mod: OK
./grub2/i386-pc/gcry_crc.mod: OK
./grub2/i386-pc/setjmp.mod: OK
./grub2/i386-pc/mda_text.mod: OK
./grub2/i386-pc/mmap.mod: OK
./grub2/i386-pc/priority_queue.mod: OK
./grub2/i386-pc/blocklist.mod: OK
./grub2/i386-pc/search_fs_uuid.mod: OK
./grub2/i386-pc/bswap_test.mod: OK
./grub2/i386-pc/video.mod: OK
./grub2/i386-pc/strtoull_test.mod: OK
./grub2/i386-pc/linux16.mod: OK
./grub2/i386-pc/trig.mod: OK
./grub2/i386-pc/cpuid.mod: OK
./grub2/i386-pc/disk.mod: OK
./grub2/i386-pc/pxe.mod: OK
./grub2/i386-pc/sleep.mod: OK
./grub2/i386-pc/video.lst: OK
./grub2/i386-pc/gcry_twofish.mod: OK
./grub2/i386-pc/lvm.mod: OK
./grub2/i386-pc/datehook.mod: OK
./grub2/i386-pc/boot.img: OK
./grub2/i386-pc/romfs.mod: OK
./grub2/i386-pc/macbless.mod: OK
./grub2/i386-pc/halt.mod: OK
./grub2/i386-pc/tr.mod: OK
./grub2/i386-pc/minicmd.mod: OK
./grub2/i386-pc/testload.mod: OK
./grub2/i386-pc/efiemu.mod: OK
./grub2/i386-pc/sleep_test.mod: OK
./grub2/i386-pc/ufs1_be.mod: OK
./grub2/i386-pc/setpci.mod: OK
./grub2/i386-pc/wrmsr.mod: OK
./grub2/i386-pc/plan9.mod: OK
./grub2/i386-pc/regexp.mod: OK
./grub2/i386-pc/testspeed.mod: OK
./grub2/i386-pc/luks.mod: OK
./grub2/i386-pc/vga_text.mod: OK
./grub2/i386-pc/gcry_sha512.mod: OK
./grub2/i386-pc/moddep.lst: OK
./grub2/i386-pc/part_acorn.mod: OK
./grub2/i386-pc/video_cirrus.mod: OK
./grub2/i386-pc/part_sunpc.mod: OK
./grub2/i386-pc/gcry_rfc2268.mod: OK
./grub2/i386-pc/configfile.mod: OK
./grub2/i386-pc/sendkey.mod: OK
./grub2/i386-pc/search.mod: OK
./grub2/i386-pc/cat.mod: OK
./grub2/i386-pc/scsi.mod: OK
./grub2/i386-pc/nilfs2.mod: OK
./grub2/i386-pc/cbmemc.mod: OK
./grub2/i386-pc/ufs1.mod: OK
./grub2/i386-pc/bitmap_scale.mod: OK
./grub2/i386-pc/progress.mod: OK
./grub2/i386-pc/zfscrypt.mod: OK
./grub2/i386-pc/gcry_whirlpool.mod: OK
./grub2/i386-pc/ntldr.mod: OK
./grub2/i386-pc/ata.mod: OK
./grub2/i386-pc/increment.mod: OK
./grub2/i386-pc/date.mod: OK
./grub2/i386-pc/usbserial_pl2303.mod: OK
./grub2/i386-pc/png.mod: OK
./grub2/i386-pc/afs.mod: OK
./grub2/i386-pc/reiserfs.mod: OK
./grub2/i386-pc/pbkdf2.mod: OK
./grub2/i386-pc/search_label.mod: OK
./grub2/i386-pc/gcry_camellia.mod: OK
./grub2/i386-pc/chain.mod: OK
./grub2/i386-pc/reboot.mod: OK
./grub2/i386-pc/datetime.mod: OK
./grub2/i386-pc/partmap.lst: OK
./grub2/i386-pc/gptsync.mod: OK
./grub2/i386-pc/gdb.mod: OK
./grub2/i386-pc/mpi.mod: OK
./grub2/i386-pc/gzio.mod: OK
./grub2/i386-pc/true.mod: OK
./grub2/i386-pc/backtrace.mod: OK
./grub2/i386-pc/hexdump.mod: OK
./grub2/i386-pc/zfsinfo.mod: OK
./grub2/i386-pc/geli.mod: OK
./grub2/i386-pc/part_gpt.mod: OK
./grub2/i386-pc/ldm.mod: OK
./grub2/i386-pc/crypto.lst: OK
./grub2/i386-pc/jpeg.mod: OK
./grub2/i386-pc/gettext.mod: OK
./grub2/i386-pc/parttool.mod: OK
./grub2/i386-pc/usbserial_usbdebug.mod: OK
./grub2/i386-pc/keylayouts.mod: OK
./grub2/i386-pc/parttool.lst: OK
./grub2/i386-pc/setjmp_test.mod: OK
./grub2/i386-pc/spkmodem.mod: OK
./grub2/i386-pc/part_apple.mod: OK
./grub2/i386-pc/xnu_uuid_test.mod: OK
./grub2/i386-pc/rdmsr.mod: OK
./grub2/i386-pc/ehci.mod: OK
./grub2/i386-pc/test.mod: OK
./grub2/i386-pc/lsmmap.mod: OK
./grub2/i386-pc/normal.mod: OK
./grub2/i386-pc/http.mod: OK
./grub2/i386-pc/videotest.mod: OK
./grub2/i386-pc/password.mod: OK
./grub2/i386-pc/time.mod: OK
./grub2/i386-pc/cmp_test.mod: OK
./grub2/i386-pc/xfs.mod: OK
./grub2/i386-pc/verifiers.mod: OK
./grub2/i386-pc/mdraid09.mod: OK
./grub2/i386-pc/ahci.mod: OK
./grub2/i386-pc/gcry_sha256.mod: OK
./grub2/i386-pc/password_pbkdf2.mod: OK
./grub2/i386-pc/usbtest.mod: OK
./grub2/i386-pc/cryptodisk.mod: OK
./grub2/i386-pc/pcidump.mod: OK
./grub2/i386-pc/test_blockarg.mod: OK
./grub2/i386-pc/echo.mod: OK
./grub2/i386-pc/minix_be.mod: OK
./grub2/i386-pc/drivemap.mod: OK
./grub2/i386-pc/multiboot.mod: OK
./grub2/i386-pc/minix3_be.mod: OK
./grub2/fonts/unicode.pf2: OK
./grub2/grub.cfg: OK
./grub2/themes/qubes/progress_bar_c.png: OK
./grub2/themes/qubes/qubes.png: OK
./grub2/themes/qubes/progress_bar2_c.png: OK
./grub2/themes/qubes/unifont-regular-16.pf2: OK
./grub2/themes/qubes/progress_bar_hl_c.png: OK
./grub2/themes/qubes/unifont-bold-16.pf2: OK
./grub2/themes/qubes/theme.txt: OK
./grub2/themes/qubes/unifont-regular-32.pf2: OK
./grub2/themes/qubes/unifont-regular-14.pf2: OK
A single bit change on /boot/kexec* file content will invalidate the detached signature validation made by Heads, where calling manually sha256sum -c on thedigest will show what file changed.
This is manual, and valid until the user regenerates digest on reboot if changes are detected and resigns the digests.
On Dom0, that could be done manually to verify changes prior of an upgrade and after, to know better what would be signed into Heads, and manually check with rpm -V (and rpm -q --what-provides call to locate rpm package) to make sure nothing but system deployed upgrades changed /boot content.