So thanks to ghdp and GnuPG or really gpg4win, I was able to check the signatures.
So now for versions 0.92.3 and 0.94.1, I've checked the checksums, the signatures and the publickey fingerprint on multiple downloaded copies from Mackay, from the old and new(goatpig) githubs, these forums (for the publickey fingerprint), and the Amory website and it's archived copies at multiple timed snapshots on the site internet archive (
https://archive.org/web/).
They all checked out so I think I'm good short of reading the code myself.
Thanks again everyone for helping me on this newbie stuff. The community here is great!