Verifying Bitcoin Core Integrity using PGP
GnuPG is telling you that the signature corresponds to that public key (your file has a valid signature and wasn't tampered with in transit), but that it doesn't know if that public key is trustworthy.

If you trust your friendly neighborhood CA, then do the following:

gpg --lsign-key 01EA5486DE18A882D4C2684590C8019E36C2E964


then enter your private key password to locally certify the key.

If you don't trust the CA (good on you for being suspicious), ask someone you know who you do trust for the key fingerprint. If that key fingerprint matches what you imported, then you can run that command. If it doesn't, then something is up.