Verify Signed Packages

We should at least use the content of the "Verify Signed Packages" commit, if not this exact application of the information.