add better error reporting for cdn downloaded tarball distributions

- Defers downloading the .asc until we find a tarball
- Report that a tarball could not be found for a specific version
- Previously a more obscure error about "GPG signature not found"
  was reported, which should only be shown if the distribution
  itself if found but there is no detached signature.
- Resolves issue #44