hosting: trust the zetbox repo until we have proper autosigning in place