Improve GPG verification

Accept a signature file as long as there's at least one good signature
from a trusted key, and borrow code from APT to explicitly verify the
structure of InRelease files.

Closes: #918304