Require gpg key before upgrade

This fixes scenarios where an upgrade is needed but the GPG key was not installed previously. I also found that the key was not detected by the upgrade command until I added `HOME=/root` to the environment.