The 4.1.3 tarball is signed with a different key than older releases (999C5EF86C5A70E5). The public key is not available in the public servers and I can't find it on krita.org either, so there is no way to verify the signature.
Oh dash it... You are right. My desktop computer broke, and I had forgotten that that was the computer I used to sign the releases.
I got the key from my old desktop and made new .sig files, but they aren't on the mirrors yet, of course. But at least they were made as foundation@krita.org, not boud@valdyas.org