GPG verification of packages

PyPI supports uploading GPG signatures along with packages. Example: https://pypi.io/packages/source/p/pycalphad/pycalphad-0.4.1.tar.gz.asc

It would be nice to be able to lock down a feedstock so that it will only allow rendering packages signed with a specified key.

(When you start thinking about how package updating would work if done properly, it seems to get complicated pretty fast: https://theupdateframework.github.io/ -- what I'm talking about here is only about securing the link between PyPI and anaconda.org via conda-forge, without concerning ourselves with the link to the end user.)