Reading a failed verification

Failures are not interchangeable. Four different causes produce four different messages, and only one of them means somebody tried to deceive you.

Bad signature

The content and the signature do not agree. Either the message was altered after signing or the signature belongs to different content. Fetch the announcement again from its original source and verify the fresh copy, because transport damage produces this too. If a clean copy still fails, treat the announcement as untrustworthy and do not use any address in it.

No public key

The signature was made with a key you do not hold. This says nothing about validity, only that you cannot check it yet. If the key identifier differs from the operator key you already imported, that is significant and worth stopping over rather than importing whatever produced it.

Expired or revoked key

The key carried an expiry that has passed, or its holder published a revocation. An expiry is routine and often extended. A revocation is a deliberate statement that the key should no longer be trusted, and an announcement signed with a revoked key should be treated as worthless regardless of how correct it looks.

Malformed input

The tool cannot find a signature to check. Almost always the block was pasted through something that altered it, or the marker lines were not included. Save the raw text to a file and try again before reading anything into it.

The order to work through

Re fetch the announcement cleanly and retry, which resolves most first failures.
Confirm you are checking against the fingerprint you recorded, not one supplied alongside the message.
Only then treat a persistent failure as a signal about the announcement rather than about your process.

What a failure is not

Evidence that the market is compromised or gone. It is evidence about one message. The correct response is to ignore that message and use an address you already held, not to go looking for a replacement.