simplify pgp-key pinning and check for existing docker image