The key on https://www.mediawiki.org/keys/keys.txt is:
Mukunda Modell (twentyafterfour) <mmodell@wikimedia.org>
C83A8E4D3C8FEB7C8A3A1998131910E01605D9AA
...
km@km-pt /tmp> gpg2 --list-keys Mukunda
pub rsa4096 2016-01-08 [SC] [expires: 2019-07-31]
C83A8E4D3C8FEB7C8A3A1998131910E01605D9AA
uid [ full ] Mukunda Modell (WMF) <mmodell@wikimedia.org>
uid [ unknown] Mukunda Modell <twentyafterfour@gmail.com>
uid [ full ] [jpeg image of size 2928]But the key used to sign the git tags and tarballs was D7B8437BE5A2D3FC8D905FED60AE06D4875BE862:
km@km-pt ~/g/m/core> git tag -v 1.32.0 object 0fbb878ef366477535a709b0c2564bdcf4b176d1 type commit tag 1.32.0 tagger Mukunda Modell <mmodell@wikimedia.org> 1547171875 -0600 MediaWiki 1.32.0 gpg: Signature made Thu 10 Jan 2019 05:58:10 PM PST gpg: using RSA key D7B8437BE5A2D3FC8D905FED60AE06D4875BE862 gpg: Can't check signature: No public key (2) km@km-pt /tmp> gpg2 --verify mediawiki-1.32.0.tar.gz.sig gpg: assuming signed data in 'mediawiki-1.32.0.tar.gz' gpg: Signature made Thu 10 Jan 2019 06:26:26 PM PST gpg: using RSA key D7B8437BE5A2D3FC8D905FED60AE06D4875BE862 gpg: Can't check signature: No public key
That key needs to be uploaded to key servers and added to keys.txt AIUI, even though it's a subkey.