Reproducible Arch Linux: import GnuPG keys before running makepkg

This means that when things fail, we get to see errors from gpg, rather
than relying on silent behavior from gpg while attempting to verify the
file (in which case all we see is "unknown public key" from makepkg
itself).

Signed-off-by: Holger Levsen <holger@layer-acht.org>