Gpg sign verify

Here's the final component (at least for today).  This will verify signature if:
1) package contains gpg signature
2) gpg is configured in PEAR
3) public key of signing authority has been imported

UI & code architecture can obviously be discussed and tweaked.  But it works, at least with the admittedly limited testing I have done so far.

The Debian folks have mentioned that they are very interested in this kind of security for PEAR packages that are packaged/distributed by them, so I can probably get some people involved as necessary if we need more support to get the ball rolling on getting this added.