mirrorbrain: check source tarball with GPG signature