That's not the point. The checksums are fine and gpg says
the signature in itself is correct. What I didn't found is how
to verify that the signature belongs indeed to Jeff.
For signatures on Linux kernel sources, for example,
there is a big web of trust to which most open source
contributors belong.

If you know Jeff personally, that's of course no problem at all.
But in general, signatures without references to such a trust web
cannot warrant that the binaries have not been replaced by
someone else. It's surely paranoid to think about that,
but for a payment system it's also the definitive worst case if
it happens one day.