Force authentication for cdebootstrap-static

Before, during initial bootstrapping, cdebootstrap-static ignored "the
unavailability of Release.gpg, missing keyrings, broken signatures, and
missing gpgv executable". This commit adds the necessary dependencies
to be able to perform the verifications. Following this commit, the
signatures/checksums on the Release file and all packages are properly
checked.