That's the problem with canaries, though. By definition, they exist for situations where the canary-owner can't offer positive evidence for compromised security

That's the problem with canaries, though. By definition, they exist for situations where the canary-owner can't offer positive evidence for compromised security. I don't particularly think Riseup is in that position, but unless someone actively says "don't worry about our lack of a canary, we took it down for $REASONS and all is well", negative evidence is all you can react to.