verify upstream source signature
    
    Per the packaging guidelines¹.
    
    The upstream key is, unfortunately, a DSA 1024-bit key.  While this is
    still accepted by gpg, it should ideally be replaced upstream.
    
    ¹ https://docs.fedoraproject.org/en-US/packaging-guidelines/#_verifying_signatures