Verify PGP signature rather than floundering about with hashes