Verifying the signature of a pkg