It seems to me that it did its job here. The only thing a warrant canary claims to be able to do is to make people aware that a warrant was served on a provider, even when a gag order prevents the provider explicitly saying so. The warrant canary at riseup disappeared, which did have the effect of making people aware of that fact.

Now it turned out that the warrant was just for some malware-extortion ring, not due to a crackdown on political dissidents, so arguably a "false positive" from the perspective of what most people using riseup for its stated purpose care about. But the warrant canary didn't claim to make those kinds of fine-grained distinctions in the first place. It claimed that it would let you know when there was an unannounced warrant, and it succeeded in doing so.

Not at all!

Riseup's response to questioning about failure to update the canary was:

    listen to the hummingbird, whose wings you cannot see,
    listen to the hummingbird, don't listen to me. #LeonardCohen

That is, "yes, there's a gag order".

Uh?

> There was a “gag order” that prevented us from disclosing even the existence of these warrants until now. This was also the reason why we could not update our “Canary”

Seems the exact purpose it was intended for. And they discuss at length why that canary was too broad and how the new one is better.