bitaddress zip from github etc - GPG signature

[samphire]

Anyone have an answer to this. When I use my GPG client (Kleopatra) to check the 'pgpsignedmessage.txt' downloaded from the bitaddress website, it says the signature cannot be verified even though I've downloaded the bitaddress GPG certificate.

Secondly, I've downloaded the 'bitaddress.org-master.zip' file from github, but it's not clear to me how I verify it hasn't been modified by someone other than the author. I realise I'm being paranoid but I like to check these things.

So I'm asking 2 things:
1. How do I verify the author against his certificate?
2. How to I verify the authenticity of the github zipped up download?

Any help gratefully received.

Thanks