do not bzip2 cdebootstrap.tar

The APK itself is compressed, and the bzip2 file is hard to make
deterministic.
force timestamps of cdebootstrap.tar and contents to that of the .deb

Use the timestamp from the downloaded .deb file to set all of the files and
the .tar file itself to the same timestamp.  This should make the creation
of the .tar file deterministic.  Some setups will extract the
cdebootstrap.deb with different permissions, so also tell tar to try to
keep the permissions as set in the tarball.
update to latest debian-archive-keyring (fixes: #93)

cdebootstrap was not happy with the old keyring file, probably
because it was missing essential keys.  This also adds a step that
downloads the keyring with each build and verifies it against the
copy that is checked into git.  Sicher ist sicher!
download cdebootstrap using an HTTPS:// mirror

This lowers the profile of the build process from a network
observer.  It also provides an extra layer of encryption in case
other layers fail.