Additionally, fix upstream URL and verify sources with the upstream OpenPGP signature. Signed-off-by: Nils Philippsen <nils@tiptoe.de>