Verify signature
Use simpler .sig bundle so only 1 fetch is needed
Convert pkg.conf to JSON
Tell which fingerprint a pkg is verified against