use rsync to copy to local repo
allow verifying of APK gpg sigs without downloading