Well, they say they use gpg to sign the file (yubico-utf-ca-certs.txt) and the signature is in the linked file. So
gpg --verify yubico-u2f-ca-certs.txt.sig yubico-u2f-ca-certs.txt
gpg: Signature made Tue Sep 2 11:18:24 2014 CEST using RSA key ID 32F8119D
gpg: requesting key 32F8119D from hkp server keys.gnupg.net
gpg: key 54265E8C: public key "Simon Josefsson <firstname.lastname@example.org>" imported
gpg: 3 marginal(s) needed, 1 complete(s) needed, PGP trust model
gpg: depth: 0 valid: 1 signed: 0 trust: 0-, 0q, 0n, 0m, 0f, 1u
gpg: next trustdb check due at 2019-08-28
gpg: Total number processed: 1
gpg: imported: 1 (RSA: 1)
gpg: Good signature from "Simon Josefsson <email@example.com>"
gpg: aka "Simon Josefsson <firstname.lastname@example.org>"
gpg: WARNING: This key is not certified with a trusted signature!
gpg: There is no indication that the signature belongs to the owner.
Primary key fingerprint: 9AA9 BDB1 1BB1 B99A 2128 5A33 0664 A769 5426 5E8C
Subkey fingerprint: 9941 5CE1 905D 0E55 A9F8 8026 860B 7FBB 32F8 119D
Ok. This shows that the file in question was signed (validly) by someone at Yubico, so it seems.
The cert itself (some_cert.pem) is self-signed so openssl has to be told to trust it: "verify" checks the chain of certificates but here the chain ends right away: the cert signs itself. In this case you want to check the signature (but this says nothing about the origin of the cert, anyone can make a self-signed cert with Yubico in the name!), so we can do
openssl verify -trusted some_cert.pem -check_ss_sig some_cert.pem
Which indeed says OK (it says to check the last (here only) link, the self-signed one, and to explicitly trust the signer; normally there is a directory of trusted certs that openssl knows about or needs to be told about in a command line argument.).
To inspect the cert (that you now trust the origin of, due to it being signed by gpg etc.) and checked the signature of, e.g. do
openssl x509 -in some_cert.pem -noout -text
which outputs all the fields including the serial, which was also in the signed text file. So now you see that all is consistent in itself. But you have to believe the gpg key (from a key server) and the fact that the file is hosted on the site etc. The gpg key is untrusted according to my gpg install...
Hope this helps.