Fixed gpg verify command

First the verify was failing because it was pointing to tails.sig (curl is outputting to tails.iso.sig). It then failed due to not having the public signing key, so I added a curl to download that and the gpg import. Do you think there may be trust issues with including that step as part of this script?