That canary has now died. It did so along with a statement [1][2] that signing a canary every 6 months with an airgapped computer is too impractical, which isn't very plausible as this is a perfectly schedulable event which will take at most an hour for every person involved, twice a year. I suppose they sign their (APT, RPM) releases in the same way (please ask them; seems answerable). Additionally, they were three days late with their statement about moving away from the canary, which is otherwise irresponsibly late for an event that can completely erode trust in them as a security company.
The irony is that their conclusion in [1] that the "canary’s effectiveness as a tool has been questioned, the usage of it at other companies is not consistent, and verifying it and keeping track of it is complicated for users" is spot on; the confusion that can be created about whether the canary is dead or merely deprecated, that after it has died once it cannot be reinstated, and that the only recourse for users is to move away from the service, makes it a pretty useless signal to act upon.
[1] https://spideroak.com/articles/transparency-report/
[2] https://twitter.com/SpiderOak/status/1025488889564327936