update to latest debian-archive-keyring (fixes: #93)

cdebootstrap was not happy with the old keyring file, probably
because it was missing essential keys.  This also adds a step that
downloads the keyring with each build and verifies it against the
copy that is checked into git.  Sicher ist sicher!
download cdebootstrap using an HTTPS:// mirror

This lowers the profile of the build process from a network
observer.  It also provides an extra layer of encryption in case
other layers fail.