PGP verification of package-index files