debian/watch: Also look for bzip2 and xz compressed tarballs.
debian/watch: Add pgpsigurlmangle option to verify upstream signature.

The PGP key used is the one from the last releases. It was not verified
further.
Update changelog.