This is where, the owner of the PGP key hopefully have verified themselfs by setting up a web of trust. In other words, that they have passed the key along to

This is where, the owner of the PGP key hopefully have verified themselfs by setting up a web of trust. In other words, that they have passed the key along to employees and other trusted (ie. large web-of-trust) tiers - which in turn have put their keys to use to verify that this key belongs to the security team of Heroku. To verify the verifications, you could contact one of the trusted parties and ask them how they are sure that the particular key is correct - if in doubt.