If their site/dns/whatever was compromised than there's no way you can trust the GPG signature at this point. I'll await a proper press release.