use fetch-keys instead of wget so we can have one apt-get update / install layer