gpg/git verifying gpg signed tags