Add notes on verifying gpg keys