[FEATURE REQUEST] Verify RPM packages GPG signature on their adding to version

[teran]

What is your use case?
Be closer to operations which made by yum/dnf than trivial rsync

Is your feature request related to a problem? Please describe.
Now the code mirrors yum repository into version checks only checksums defined in repomd.xml and other index files but doesn't check RPM GPG signature which have some security impact to final repository users. So to improve the security it's needed to verify GPG signatures (if possible) for RPM packages.

Describe the solution you'd like

• If RPM package is not uploaded to blob storage yet - check signature of that package against the key provided to archived-cli via argument (if it's provided)
• If check passes - upload the blob
• If check fails - fail the run

Describe alternatives you've considered
up to discuss

Additional context

https://github.com/cavaliergopher/rpm have already implemented method to verify package GPG signature against the provided key, however it utilizes deprecated https://pkg.go.dev/golang.org/x/crypto/openpgp package (See https://golang.org/issue/44226 for details) so it's up to consider a way to implement that feature on something maintainable like https://github.com/ProtonMail/gopenpgp and reuse just some lower level methods from https://github.com/cavaliergopher/rpm

UPD: https://github.com/sassoftware/go-rpmutils - this library looks more fresh and maintainable, already using ProtonMail's openpgp implementation.