The idea is that you have a message you update regularly to specify whether you have received an NSL -- you never delete the latest version. If you get an NSL you comply by doing nothing (and by your inactivity you've signalled that the warrant canary was tripped). There is a valid freedom-of-speech question (at least in the US) about whether you can be compelled to continue updating the message -- you can be forced to be silent but can you be forced to proactively lie when the NSL forced you to be silent?
Though, of course, they could subpoena the signing key for the canary and destroying the key would be destruction of evidence. A quorum system for signing might be more robust against this, but I have my doubts.
And of course quite a few folks think that warrant canaries wouldn't work in any case[1].
[1]: https://www.schneier.com/blog/archives/2015/03/australia_out...