https://dwaves.de/2018/01/27/gpg-verify-downloaded-software-no-public-key/