[Implement rule][non-essential] Check that packages are cryptographically signed with GPG

[fhocutt]

Implementing this will require package files to be present in the repository or for their location to be specified.