Better document How to verify PGP signature

Add text clarifying our unusal packaging of the PGP signature inside a
tar file.

ticket: 7927
target_version: 1.13
tags: pullup