Better document how to verify PGP signature

Add text clarifying our unusual packaging of the PGP signature inside
a tar file.

ticket: 7927
target_version: 1.13
tags: pullup