disable database and package signature verification

This is a job for pacman. No need to replicate it in expac. People
(rightfully) complain about gpgme sucking ass and hanging on
verification. I can't replicate this behavior, but it doesn't surprise
me, and I'm not wasting my time to figure out why.

For extra credit, maybe I can convince people to stop blindly signing
and trusting random 3rd party keys.