Update d/watch to get tarball & verify signature
- d/watch: update to find upstream tarball, and verify its signature
- d/upstream/signing-key.asc: added, downloaded from https://github.com/rabbitmq/signing-keys/releases/download/3.0/rabbitmq-release-signing-key.asc