Alikins/ostree gpg http

Meaning should we include 'gpg-verify=true' vs not including it? ie,
only specify if 'gpg-verify=false' ?