verify upstream GPG signature
    
    Follow the "Source File Verification" packaging guidelines¹.  Adjust the
    git ignore pattern to match the .sig file and use a glob to avoid neding
    to update it for each upstream release.
    
    While here, fix the make BR alignment (tabs are used in this spec file
    rather than spaces).
    
    ¹ https://docs.fedoraproject.org/en-US/packaging-guidelines/#_source_file_verification