public: support `gpg-sign` and `gpg-key` options

This is a WIP for adding signatures to the npm packages. Fully enabling it will require server changes too.

Let's discuss the approach here:

* Does GPG seems a good idea for you?
* How will that work on server-side? Will server store all user's public keys and be a PGP endpoint by itself?
  Or should users upload their public keys to their accounts manually with `npm`?

I did not do much, so hopefully you won't be biased to this because of me implementing part of it without approaching consensus. This is mostly a proof of concept.