Adding PGP signature verification for Arch Linux packaging scripts (PKGBUILD)

This is a continuation of [discussions on Arch Linux User Repository (AUR)](https://aur.archlinux.org/packages/keybase-bin/?comments=all). /cc @oconnor663 as requested.

In [the current Arch Linux packaging script (PKGBUILD)](https://github.com/keybase/client/blob/master/packaging/linux/arch/PKGBUILD.bin.in), detached signatures of Debian packages are not verified. If I want to check whether the downloaded file is really from Keybase, I need to download https://s3.amazonaws.com/prerelease.keybase.io/linux_binaries/deb/keybase_1.0.36-20171122003226.f68b10ef8_amd64.deb.sig and https://keybase.io/docs/server_security/code_signing_key.asc manually. I propose to apply emlun's patch
```Diff
diff --git a/PKGBUILD b/PKGBUILD
index 5fda4e1..56a3da9 100644
--- a/PKGBUILD
+++ b/PKGBUILD
@@ -18,10 +18,13 @@ depends=(fuse gconf libxss gtk2) # don't change this without changing the SRCINF
conflicts=(keybase keybase-release keybase-git)
source_i686=(
"https://s3.amazonaws.com/prerelease.keybase.io/linux_binaries/deb/keybase_${deb_pkgver}_i386.deb"
+ "https://s3.amazonaws.com/prerelease.keybase.io/linux_binaries/deb/keybase_${deb_pkgver}_i386.deb.sig"
)
source_x86_64=(
"https://s3.amazonaws.com/prerelease.keybase.io/linux_binaries/deb/keybase_${deb_pkgver}_amd64.deb"
+ "https://s3.amazonaws.com/prerelease.keybase.io/linux_binaries/deb/keybase_${deb_pkgver}_amd64.deb.sig"
)
+validpgpkeys=(222B85B0F90BE2D24CFEB93F47484E50656D16C7)
install=keybase.install

package() {
@@ -43,5 +46,5 @@ package() {
rm -rf "$pkgdir/etc/cron.daily"
}

-sha256sums_i686=(994998f8093474330a1249e75963cacc948b8011ef5dff6e2e98085fa58448ba)
-sha256sums_x86_64=(35bd09c324828c125ecb68e83b3c54a36f8c48d61b09352593a62d64476f2802)
+sha256sums_i686=(994998f8093474330a1249e75963cacc948b8011ef5dff6e2e98085fa58448ba 'SKIP')
+sha256sums_x86_64=(35bd09c324828c125ecb68e83b3c54a36f8c48d61b09352593a62d64476f2802 'SKIP')
```

So that makepkg (Arch Linux's default package builder) can do pgp signature verification automatically.

Some existing arguments for not adding this check:

* Verifying SHA256 checksums is enough

First, integrity != authenticity. Second, technically I can't verify that the checksum is correct. For example, the checksum for the x86_64 package version 1.0.36-20171122003226.f68b10ef8 ```35bd09c324828c125ecb68e83b3c54a36f8c48d61b09352593a62d64476f2802``` does not appear anywhere other than the AUR package according to [Google](https://www.google.com/search?q=35bd09c324828c125ecb68e83b3c54a36f8c48d61b09352593a62d64476f2802) and [DuckDuckGo](https://duckduckgo.com/?q=35bd09c324828c125ecb68e83b3c54a36f8c48d61b09352593a62d64476f2802). As a result, I need to trust several things before trusting the checksum
(1) The machine that runs [update_aur_packages.sh](https://github.com/keybase/client/blob/master/packaging/linux/arch/update_aur_packages.sh)
(2) The AUR server aur.archlinux.org

On the other hand, trusting the PGP signature is much simpler. I can get the public key from https://keybase.io/docs/server_security/our_code_signing_key or public key servers (MIT, Ubuntu, ...), and there are many evidences that ```222B 85B0 F90B E2D2 4CFE B93F 4748 4E50 656D 16C7``` is related to Keybase.io. Unless all of them are compromised, I'm safe.

Other related arguments:

> Would an evil PKGBUILD include the right Keybase PGP fingerprint

A user should always verify the fingerprint listed validpgpkeys before building a package.

> do we expect those targeted users to realize that a verification step *should have* been there?

Users of the keybase client (or any security-related software in general) should know how trust of software packages is established. They are in danger if they don't know it. Actually, it's shocking for me that the keybase-bin package does not include validpgpkeys - I was expecting a nice error message from makepkg to tell me which key I should fetch and verify for this package.

* It will bother users to force the pgp verification check

As more and more security-related and general softwares on AUR come with the ```validpgpkeys``` directive, I believe AUR users are quite familiar with them.

---

I appreciated usability for the keybase client as one of the core spirits honored by the team. I'd like to thank you all for greatly improved UI in comparison to existing security-softwares. In this case, usability of newcomers conflicts with convenience of know-how users. I think keybase should give nice instructions for newcomers to protect themselves, such as detailed instructions as comments or printed with ```echo``` in PKGBUILD, pinned comments on AUR, and so on.

As a fallback option, if you really hesitate on adding signature verification, please provide SHA256 sums of Debian packages somewhere on the website. https://keybase.io/docs/the_app/install_linux appears to be a good place.

Start with packaging/linux/arch/PKGBUILD.bin.in and packaging/linux/arch/update_aur_packages.sh, then review how makepkg handles source signatures and validpgpkeys. Done means the Arch packaging script fetches the detached signatures and configures PGP verification for both architectures without weakening existing checksum handling.

Written by the indexing model from the issue text.