The signature is correct. You probably don't have the security list key in your GPG keyring. Another option is that the application you use to verify the signature is confused. In any case the verification works fine on clean Ubuntu 16.04 system. First import the correct key:
$ gpg --list-keys
$ wget --quiet https://swupdate.openvpn.net/community/keys/security.key.asc
$ cat security.key.asc |gpg --import
gpg: keyring `/home/samuli/.gnupg/secring.gpg' created
gpg: key 2F2B01E7: public key "OpenVPN - Security Mailing List <security@openvpn.net>" imported
gpg: Total number processed: 1
gpg: imported: 1 (RSA: 1)
gpg: no ultimately trusted keys found
$ gpg --list-keys
/home/samuli/.gnupg/pubring.gpg
-------------------------------
pub 4096R/2F2B01E7 2017-02-09 [expires: 2027-02-07]
uid OpenVPN - Security Mailing List <security@openvpn.net>
sub 4096R/F6D9F8D7 2017-02-09 [expires: 2018-03-06]
sub 4096R/8CC2B034 2017-02-09 [expires: 2018-03-06]
Now the security list key is in the keyring. Next fetch the actual file and signature and verify:
$ wget --quiet https://swupdate.openvpn.org/community/releases/openvpn-install-2.3.16-I601-x86_64.exe
$ wget --quiet https://swupdate.openvpn.org/community/releases/openvpn-install-2.3.16-I601-x86_64.exe.asc
$ gpg -v --verify openvpn-install-2.3.16-I601-x86_64.exe.asc
gpg: armor header: Version: GnuPG v1
gpg: assuming signed data in `openvpn-install-2.3.16-I601-x86_64.exe'
gpg: Signature made Fri 19 May 2017 11:21:50 AM EEST using RSA key ID 8CC2B034
gpg: using subkey 8CC2B034 instead of primary key 2F2B01E7
gpg: using PGP trust model
gpg: Good signature from "OpenVPN - Security Mailing List <security@openvpn.net>"
gpg: WARNING: This key is not certified with a trusted signature!
gpg: There is no indication that the signature belongs to the owner.
Primary key fingerprint: F554 A368 7412 CFFE BDEF E0A3 12F5 F7B4 2F2B 01E7
Subkey fingerprint: B596 06E2 D8C6 E10B 80BE 2B31 D72A F344 8CC2 B034
gpg: binary signature, digest algorithm SHA1
As you can see, it says "Good signature" above.
