Start verifying sources using the upstream OpenPGP signature. Signed-off-by: Nils Philippsen <nils@tiptoe.de>