Add Sections Requested by Nick

Add sections for (1) Establishing initial trust in the Root keys and (2) Verifying PyPI projects that are externally hosted (according to PEP 470).