Couple of cleanups I found when deploying to a clean environment

The gpg key has to actually be a level deeper than I was originally putting it
so the clients can access it via the web server.