fedup.download: fix traceback in check_signed_file

return_keyids_from_pubring needs a gpgdir as an argument. Also, the
values it returns aren't the same as the RPM version strings, so massage
them into a form we can compare properly.

Oh, and add some log messages while we're at it.
fedup.download: change check_signed_file return value

Instead of just returning True/False (and throwing away the error
message), return a list of error messages so the caller can present them
to the user. An empty list indicates success.