You've gotta check if they published their GPG signature somewhere else before, either in their social media pages, internet web cache, or forum.