fedup.download: minor import cleanup
fetch/verify .treeinfo.signed if gpgcheck is on (#877623)

If instrepo.gpgcheck is True, we will try to fetch .treeinfo.signed and
verify its GPG signature; if that fails, raise an exception and bail
out.

Since we also use .treeinfo to check the integrity of the boot images,
if the .treeinfo signature is good then we can assume that the boot
images are also authentic.
Add --nogpgcheck

If you really need to disable GPG signature checking for some reason,
the --nogpgcheck flag will cause fedup to completely skip all signature
verification for packages and boot images.
add util.rlistdir()

Returns a generator that recursively descends the given directory and
yields all of the files found. Basically listdir(), but recursive.
Add comment about API stability to __init__.py

Seriously, this isn't a library for public consumption, please don't use
it as such. If you think you need to do this for some reason, email me
and we'll figure something out.
fixes for check_signed_file() etc.

This patch fixes a couple of problems with check_signed_file and friends
* missing 'self' argument
* handle 'file:///' path arguments
* add better comment for _checkSignatures
* minor refactoring
* remove our _getKeyImportMessage (the existing one works fine)
Add/import keys for instrepo so we can check .treeinfo.signed

In order to check .treeinfo.signed we need to find its key. In the
absence of a user-supplied key (which will be added in a future patch),
we need a default key - just like the default repo.

Once we have a key file, we import it into fedup's personal keyring.
We can then use that in check_signed_file to verify .treeinfo.signed, as
expected.