Verify upstream source signatures
    
    Per the packaging guidelines¹.
    
    While updating the git ignore rules, anchor the patterns to the
    top-level and ignore expanded source directories.
    
    ¹ https://docs.fedoraproject.org/en-US/packaging-guidelines/#_verifying_signatures