You can verify diasp.org Warrant Canary status with this command on your system console

delv _canary.diasp.org txt +short
OR
dig _canary.diasp.org txt +short (this will get you results without validating the DNSSEC is valid)

You would get a response of:
"version=canary1; warrants=0; date=20190814; expires=20191214;"

Meaning:
version= DNS Warrant Canary Version
warrants= number we have been issued
date= YYYYMMDD of when this was issued
expires= YYYYMMDD of when this expires, if expired then canary is dead

Running with +vtrace to validate the RRSIG:
delv _canary.diasp.org txt +vtrace
; fully validated _canary.diasp.org. 62573 IN TXT "version=canary1; warrants=0; date=20190814; expires=20191214;" _canary.diasp.org. 62573 IN RRSIG TXT 10 3 86400 20190926000000 20190905000000 34464 diasp.org. TrpV5BRz2r7wMv8s8ulkIQB2LQu4PEGAy0rNdmQwIqIoSo2Nji3adXqz ocqKR4mSF3e0ijna7KthcCFu0DiG9IrhcQeE/+Gz0BSwfjcNio/qfdTp lvOD/msZqD94b8QOYRHCzLiQxJftTlj5kgEKLNUSQMb7CsTUm0PIW3w/ wpU4WNXt40d64o6oTdEdFPqlKv6Ij503Sgm8tPYFcZkznC/MMQnIeK83 U6tL7f2wWwTMoU/0xB+UziX6rfBDtR1NNIIZAUcctCzhmJqCBxHPntxl 32dn24cx/hl9ayi6W58gRrQswvq9QgHM0lCohWNfaZZ1iXOTvnF0inLz savxeQ==

Validate my identity on Keybase