RFE: inline-sign .dsc files

It is typical for Debian/Ubuntu to sign all `.dsc` files. This ticket explores the possibility of having merfi handle this.

An example of an inline-signed `.dsc` file (the curl package for trusty): http://us.archive.ubuntu.com/ubuntu/pool/main/c/curl/curl_7.19.7-1ubuntu1.dsc

The problem is that this affects the reprepro metadata, because the .dsc file's overall checksum changes after it gets signed.

An example of a metadata file that contains a checksum of a `.dsc` file is http://us.archive.ubuntu.com/ubuntu/dists/trusty/main/source/Sources.bz2

The workflow would have to look something like this:
1. Inline-sign the `.dsc` file (conventionally Debian developers use `debsign` for this, but technically it could be done with `gpg` or `rpm-sign`)
2. Add the signed `.dsc` file using `reprepro`
3. Sign the repo's `Release` files (as merfi already does).

Alternatively, if we wanted to do the signing without interleaving `reprepro`, another workflow might be:
1. Add the unsigned `.dsc` file to the repo, using `reprepro`
2. Inline-sign the `.dsc` file
3. Re-write the sha sums for the newly-signed `.dsc` file within the `Sources` file(s)
4. Re-write the sha sums for the newly-altered `Sources` within the `Release` file
5. Sign the repo's `Release` file (as merfi already does).

This is more complex, more tightly coupled with the behavior of reprepro, and more prone to possible errors. On the other hand, the advantage is that `reprepro` can be run only once at the beginning, before anything has to be signed.

Maybe it would be easier to package and build reprepro for Red Hat rel-eng's platform (ie RHEL 6) than it would be to implement this "fiddle with the checksums" workflow in merfi.