verify upstream GPG signatures in %prep
    
    Automate verification for both cgit and git tarballs.  This is one less
    manual step for maintainers when updating a package.
    
    The GPG key for git should generally be copied from the git package:
    https://src.fedoraproject.org/rpms/git/raw/master/f/gpgkey-junio.asc