mention removal of embedded js in debian/changelog
add cryptographic signature verification to debian/watch