You can verify diasp.org Warrant Canary status with this command on your system console

delv _canary.diasp.org txt +short
OR
dig _canary.diasp.org txt +short (this will get you results without validating the DNSSEC is valid)

You would get a response of:
"version=canary1; warrants=0; date=20200922; expires=20210614;"

Meaning:
version= DNS Warrant Canary Version
warrants= number we have been issued
date= YYYYMMDD of when this was issued
expires= YYYYMMDD of when this expires, if expired then canary is dead

Running with +vtrace to validate the RRSIG:
delv _canary.diasp.org txt +vtrace
; fully validated _canary.diasp.org. 3599 IN TXT "version=canary1; warrants=0; date=20200922; expires=20210614;" _canary.diasp.org. 3599 IN RRSIG TXT 8 3 3600 20210120222806 20201022222806 2106 diasp.org. MJlEZhdPQ0/ICg9UKy9D8NZNCvLrh9JjHcwsh1gFr1oEyIHBLSWPCbmq ffcohzzyrqZYdYTsAE90lZ27SLAjnvotgxbba59xqu2iFWTLYvDqeiEN QdEm+FrKXtLsjEhXNlEeOuGYsjvMpkUG3E0tMpzvB87sjE4gVhnJ59Nx Tr0=

Validate my identity on Keybase