Fix signature verification

Signature verification was broken because `repos` refers to the root element of the JSON, where no `key` element is defined, but `repo` refers to a repo, where the `key` element is defined.