Keep a known key
Import the operators' public key once, from a source you trust, and write down its fingerprint.
Verify the block
Run the signed list through your PGP tool. You want a good signature from the fingerprint you recorded.
Mind the boundaries
Only the text between the signature markers is covered. Addresses added above or below the block are not.
Bad signature
If verification fails, ignore every wethenorth market mirror in that message, no matter how official it looks.
Only mirrors inside a validly signed block from the known key are confirmed.