check GPG signatures on tarballs