Did Apple sign this? Check it here, without asking Apple.

Paste an App Store receipt or a StoreKit 2 JWS. The same npm package verifies it in this browser or on a Cloudflare Worker, against Apple's pinned root certificates.