Force authentication for cdebootstrap-static

Before, during initial bootstrapping, cdebootstrap-static ignored "the unavailability of Release.gpg, missing keyrings, broken signatures, and missing gpgv executable". This commit adds the necessary dependencies to be able to perform the verifications. Following this commit, the signatures/checksums on the Release file and all packages are properly checked.

Note that before this change, downloads of all of the packages during installation were performed over an unencrypted http connection with no verification, so they were subject to man-in-the-middle attacks.