Don’t read bundle sources or signing keys from disk

This was to allow third party indexes but we newer got anywhere with that, so it’s just unnecessary code complexity and the potential for problems if the files on disk are wrong.