de0u Cool, thanks - I thought that was generated by grapheneos - always something new to learn!
OK, I uninstalled the version of signify I had installed and installed the bsd version instead (not terribly intuitive but I'm fond of OpenBSD, so there's that). :-)
Unfortunately, I now get this new error ...
$ curl -O https://releases.grapheneos.org/allowed_signers.sig
signify -V -m allowed_signers -x allowed_signers.sig -p factory.pub
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
100 144 100 144 0 0 436 0 --:--:-- --:--:-- --:--:-- 437
bash: /usr/bin/signify: No such file or directory