Use HTTPS for GPG keys and mirror lists

This pull requests is intended to resolve #5. Each commit can be applied individually.

To verify that all the urls work you can run something like:
```sh
grep -r fedoraproject.org * | perl -pe "s/.+'(http[^']+).+/\$1/;s/\\\$basearch/x86_64/" | sort | \
uniq | xargs -n1 curl -s -w '%{http_code} %{url_effective} [%{size_download}]\n' -o /dev/null
```