add pubkey to verify the authenticity of published gems