Verify the checksum of the upstream packages, and verify if the checksum is gpg-signed

[Zlopez]

This feature is described here fedora-infra/anitya#191.

Example: http://www.postgresql.org/ftp/source/v9.2.0/ there is a .md5 file.

The packager could list the gpg key, and we will just check against it. The idea is to check the key didn't change from the past, rather than doing the full verification of identity.

Bonus point, we could start to rank upstream by some metrics on "being serious by using more than md5, using a proper gpg key", ie assess usage ( so checksum + signature ), and then later people using strong enough keys and checksum ( like what qualys did for SSL ).