Perhaps I'm doing this wrong but when I try to verify the gpg signature I get
gpg: Signature made Tue Aug 16 01:01:19 2016 EDT using RSA key ID 139A768E
gpg: Good signature from "Riseup Networks <collective@riseup.net>" [unknown]
gpg: aka "Riseup Treasurer <treasurer@riseup.net>" [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg: There is no indication that the signature belongs to the owner.
Primary key fingerprint: 4E07 9126 8F7C 67EA BE88 F1B0 3043 E2B7 139A 768E