A common method is to create a detached signature in a
.sig file (usually a PGP signature by using
gpg -b – X.509 is very uncommon), and provide both files in the same location. For example:
This can be used with any kind of file, but the user will have to verify the signature manually using
Unfortunately, out of those currently in use, no archive format (that I know of) has support for built-in signatures using PGP or X.509. (This is excluding CAB, which is used by Windows internally but practically nowhere else, and is rather complicated to sign). WinRAR is able to add an "authenticity verification" record using a proprietary format, but it uses your WinRAR license as the signing key, which has been cracked repeatedly.
On Windows (and soon Mac OS X), it is possible to create a "self-extracting archive" – a digitally-signed executable that extracts an archive from within itself – this is how software installers on Windows work, for example. However, SFXs are limited to a single operating system, so they only suitable for distributing programs, not documents or pictures. (Java programs can be signed and are cross-platform, but few systems still have a Java runtime.)