The signature can be validated with a public key not available on the server.

"can be' is different from 'is'.

Since the attackers had root, what if they served up rootkitted kernels 1% of the time someone downloaded a tar ball?

The downloaders will have to be aware of the "no warranty" clause of the license Linux uses, and take responsibility for the software they bring into their environment. The kernel developers provide instructions[1] on how to cryptographically verify the authenticity of a downloaded kernel, including building a PGP "trust path" to their key.

1: http://kernel.org/signature.html

The signatures themselves are hosted on kernel.org...

So? An attacker's not going to have the private key they were created with, and probably won't have a private key that you have an existing trust relationship to.

The linux kernel archive public key (which is needed to verify the signature) is well known and many people have it's own copy for several years. But if the atacker gained access to the private key, he would be able to sign trojanized tarballs without anybody noticing. On the one hand kernel.org page doesn't mention this kind of breach and the key is still used, on the other hand there are rumors (https://lwn.net/Articles/457142/) that the private key was available on the compromised server so that the atacker could produce trojanized tarballs with proper signature - but I find it unlikely because the kernel.org admins doesn't warn users about it and haven't changed the key.