I have downloaded the Fedora-33 KDE spin and am attempting to verify it.  Following the instructions (appended below for convenience) I have:

The verification fails with this message:
$ gpg --verify-files *-CHECKSUM
gpg: Signature made Fri 23 Oct 2020 08:09:07 AM PDT
gpg:                using RSA key 963A2BEB02009608FE67EA4249FD77499570FF31
gpg: Good signature from "Fedora (33) <fedora-33-primary@fedoraproject.org>" [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: 963A 2BEB 0200 9608 FE67  EA42 49FD 7749 9570 FF31
This doesn't look good.  How can I verify the CHECKSUM file?

Verification instructions from https://spins.fedoraproject.org/en/verify follow:
Next, import Fedora's GPG key(s):
$ curl https://getfedora.org/static/fedora.gpg | gpg --import
You can verify the details of the GPG key(s) here.
Now, verify that the CHECKSUM file is valid:
$ gpg --verify-files *-CHECKSUM
The CHECKSUM file should have a good signature from one of the following keys:
Finally, now that the CHECKSUM file has been verified, check that the image's checksum matches:
$ sha256sum -c *-CHECKSUM
If the output states that the file is valid, then it's ready to use!