package-get and PGP signature