Verify OpenPGP signature of upstream tarball.