check gpg signatures during source validation