Use libxar instead of pkgutil to verify pkgs.