download_sigver: Try to use default key server

(to be squashed onto "GPG signature verification tool")
download_hashver: Add comment about use of symlink

(to be squashed to "Hash verification tool")
curl: Fix handling of failed integrity check

This patch is an example of how failed integrity checks can be handled
in a more robust way. Without this patch, a once failed 'make prepare
PKG=curl' does not leave any trace of the verification state. Hence,
a successive attempt to perform the 'make prepare' step again will
succeed even if the signature check failed.

To solve this problem, the outcome of a successful signature check is
represented by a tag file called 'download/<archive-name>.verified'.
Because the rule for extracting the archive depend on the .verify tag
file, the extraction won't happen until the signature check succeeded.