remove stale comment
add and cleanup docstrings in the distribution api
add --skip-gpgcheck to sandbox command

- initial scaffolding for gpg support
implement gpg verification of downloaded tarball distributions

- dbsake now fetches the detached signature for the requested
  version
- tarballs are now filtered through gpg --verify whose exit
  status is used to detect mismatches
- gpg logic is skipped when --skip-gpgcheck is specified
- Resolves issue #5
Merge branch 'feature/tarball_gpg_verification' into develop
add --skip-gpgcheck to mysql-sandbox documentation