Fixed error reporting of bad GPG signatures

Include stdout from gpg in the error report when checking a signature
fails.

Also, gpg read stdout and stderr in parallel. Otherwise, if gpg
generated a (very) large amount of error output, we might deadlock.