These steps can be simplified if you use UNIX, as most of the tools are already available. However I assume you use Windows.
For PGP explanation, search for videos on youtube.
These steps are for the webpage bitaddress.org.
For the PGP part:
1. Download and install Gpg4win.
2. Go to bitaddress.org and click on the link at the bottom to go to Github Repsitory.
3. On their Github page, click on 'CHANGELOG.txt.asc', then click on the 'raw' tab.
4. Right-click and save as.
5. Run Kleopatra(Gpg4win).
6. Click on Decrypt/Verify tab.
7. Find the CHANGELOG file you just downloaded and 'open'.
8. Now click on the 'search' tab, since you are missing the public key to verify the message.
9. The public key for ninja should have been found, click to import it.
10. Click OK/YES when asked to certify the fingerprints, we know it is the correct ones since the key fingerprint is posted on https://bitcointalk.org/index.php?topic=43496.0 .
11. You will be asked to create a account, click yes.
12. Type whatever you want(not important).
13. Create a simple password.
14. Click 'finish'.
15. Select all the IDs, and then tick the box ' I have verified the fingerprint'and next.
16. Click certify.
17. Enter the password you just created.
18. You will get certification successfull, click finish.
19. Now you will be shown if the contents inside CHANGELOG is valid.
20. If you get "The signature is valid and the certificate's validity is fully trusted." Then we know that the file content is authentic and hasn't been tampered with.
21. So now we know that the file CHANGELOG.txt.asc inside their Github is authentic. We can process to the SHA256 part.
For the SHA256 part:
1. Go to bitaddress.org and right-click and save as 'Webpage HTML only'
2. Download and run QuickHash.
3. In QuickHash go to 'file' tab and select SHA256 as Hash Algorithm.
4. Click 'Select File' and select the html file you just downloaded.
5. A SHA256 HASH value will appear.
6. Now go to bitaddress.org again, and at the bottom of the page click at the link to GitHub Repository.
7. Once in their GitHub, click on the file 'CHANGELOG.txt'.
8 At line 29 you will find
9. Do the "dec17c07685e1870960903d8f58090475b25af946fe95a734f88408cef4aa194" match with the SHA256 you got from QuickHash?
10. If matched, then the HTML you dowloaded is valid and authentic, if not, then something sketchy is going on.