Validate pgp signatures

[dignifiedquire]

Ref #2028

[kinnison]

This looks amazing as a first-cut. We need to have tests which verify that if signatures exist which are bad, we get appropriate warnings, and then we need to think about how we're going to handle the keyring more effectively than the current pair of commented lines; but thank you and I hope my suggestions are useful.

[dignifiedquire]

I will need to wait for a more configurable way for keys to put in the real thing unfortunately, as cfg(test) is not applied when running the tests in the tests directory (ref likely rust-lang/rust#59168)

[bors]

☔ The latest upstream changes (presumably #2079) made this pull request unmergeable. Please resolve the merge conflicts.

[kinnison]

This is looking pretty good now. I'm thinking about how I want to provide key configurability. I will hopefully have an answer for you in the next few days.

[kinnison]

This is starting to look like it's near to ready.

[kinnison]

I think we need to start tidying this into a series of functional commits so that we can get ready to merge. This is looking amazing.

[kinnison]

That test looks 👍

[kinnison]

That makes sense, here's hoping it sorts appveyor out :D