Verify downloaded packages and include GPG keys in installer

This pull request is a superset of #63 and is rebased off of the latest master. Compared to #63, this includes a few small fixes, uses a temporary keyring instead of the user's personal keyring, adds additional functionality to fix issue #64, and improves the interface of `update.sh`. The individual commit messages provide more detail.

Please double-check the fingerprints in `update.sh`. I think they are accurate but don't have a good way to verify them directly.