The part after the colon in "The signature is invalid: Invalid Signature" is the error returned by gpg that's responsible for the invalid signature. It could potentially be some other reason. Of course, we can simply not show the error anymore. Obviously, this would remove some details, but maybe that's okay. People could still look at the audit protocol for further information.

I don't really think it's a good idea to speculate about the reason for the invalid signature. An invalid signature has to raise a red flag. Always. If people start to ignore invalid signatures then all hope is lost.

It is trivial append a bogus signature and would thuns inhibit to check the expected signature.

In reply to Ingo:
Ok, I can live with that but I still would like this message to be improved.
Looking at it some more I noticed some other details which bother me:

a) In contrast to in a "Valid Signature" message (which seems to be always on a new line), there is no line break before "Invalid Signature"
b) The text continues in the new paragraph with "With certificate:". But there is no line "Signature created on $DATE" before that which makes the meaning unclear. Could we print that line here, too? And only prepend it with "Invalid" to not cause confusion? -> "Invalid signature created on $DATE"
c) Red text on a red tinted background is not really good for a11y …

A minimal fix would be:

• Line break before the "Invalid Signature" (so it's the same formatting as with valid signatures)
• Then after the space a line "Invalid Signature with the certificate:"
• Delete the lines below the certificate.

But we decided to wait and completely rework those messages (invalid and valid) and make them better to grasp at a glance.
To be continued…