Fix signature verification

Signature verification was broken because `repos` refers to the root element of the JSON, where no `key` element is defined, but `repo` refers to a repo, where the `key` element is defined.
Edit: This pull request still needs more work, I'll update it in the next few days