Add GPG signature verification to documentation

Blocked by https://github.com/composer/getcomposer.org/issues/71