Tor browser installation hangs on verifying signature

The thing that hangs is gpg. Run ps -ef | grep gpg while tor is verifying signatures and see there's actually a gpg running.
Tor browser installer will run gpg --refresh-keys anyways, so (from here)

Because of some jerk on the internet poisoning PGP keys, downloading and using the TB developers' poisoned key will take forever

But we don't need to follow the link to cure the gpg db, as it has another home directory. We just need to download and install the 'poisoned' key safely.
This thing is implemented in gpg 2.2.17 and later versions. So you need to /usr/bin/gpg --version and update gpg if it's older than 2.2.17.
The update process is rather simple, too: get to this git gist, load the script, replace 2.2.10 with 2.2.17 within the script and run download, compilation and make.
Maybe you should copy /usr/local/bin/gpg* over /usr/bin/gpg* after it.
Enjoy )

gpg (GnuPG) 2.2.17
libgcrypt 1.8.3
Copyright (C) 2019 Free Software Foundation, Inc.