Warn when an unsigned gem is verified

Part of #474
Warn if an untrusted certificate is seen

This warning and the warning for @042d75c are absolute.  The policy
doesn't no which type of policy it is.  Future versions may add or
remove protections so the warning should happen even if using the "no
security" policy.

Fixes #474