Add GPG signature verification to documentation

Blocked by https://github.com/composer/getcomposer.org/issues/71
Solves #2665

Also: https://scott.arciszewski.me/blog/2014/08/dont-use-composer-php