Use gpg and sha256 verification