In PKI, when someone wants to verify that the certificate is valid, what do they use to decrypt the signature?

The receiver's digital signature is irrelevant to certificate validation - the signature being verified belongs to the CA, not the receiver.

The CA's private key is used to create the signature during certificate issuance, not to verify it; exposing the private key for verification would completely compromise PKI security.

A secret passphrase is a symmetric credential concept and plays no role in the asymmetric PKI certificate verification process.

The Certificate Authority signs a certificate by hashing its contents and encrypting that hash with the CA's private key, producing the digital signature. Any party wishing to verify the certificate's authenticity decrypts the signature using the CA's publicly available public key and compares the resulting hash to a freshly computed hash of the certificate. This asymmetric process ensures that only the CA could have produced the signature, establishing trust without requiring a shared secret.