Force authentication for cdebootstrap-static

Before, during initial bootstrapping, cdebootstrap-static ignored "the
unavailability of Release.gpg, missing keyrings, broken signatures, and
missing gpgv executable". This commit adds the necessary dependencies
to be able to perform the verifications. Following this commit, the
signatures/checksums on the Release file and all packages are properly
checked.
Improved code for setting the date.

In the old situation there was 1 try to set the date and if it failed,
most files had 1970-01-01 as date. Not ideal, but not fatal either.
But when using GnuPG the date becomes more important, so now there are
several tries to set the date correctly.