add gpg verification of tarball