Remove ChangeLog from debian/docs because it will be included automatically.
Verify the upstream tarball using cryptographic signature.