fix instrepo key import

We need to import instrepo's key(s) *after* we create gpgdir, obviously.
Move it into check_signed_file() so it happens at the right time.
refactor: drop _import_key()

This only got called from one place, and we can do a better job than
this. Move the code into the place it was called from.
refactor: add init_keyring, list_keyring, import_key

More code refactoring. No behavior changes except perhaps slightly
different log messages.
refactor: add _setup_keyring()

Moving this into its own function makes logical sense - it's possible we
might want to use it elsewhere, but it's also much easier to understand
what's actually going on here.
fix rm_rf() for non-directories

C'mon, let's use the BIG hammer!!
use a clean gpg keyring every time

This makes sure we don't end up with stale/no-longer-trustworthy keys
stuck in a cached GPG keyring.
download.py: improve logging from check_keyfile etc.

Makes the logs clearer and easier to read.
check_keyfile: fix false positive for RPM trust

It turns out that keyInstalled returns -1 if the keyid isn't found in
the RPM database... which evaluates to True. Yikes.

This patch makes check_keyfile properly reject keys that came from
packages signed with an *untrusted* key.