signing packages

As an optional feature, we might provide cryptographically signing the packages using PGP and verifing the signatures at install. I will most probably not work at this feature, but if someone is interested, contributions are welcome