pgp key for the package list