Changes

External GPG signature verification

If an external GPG is used for signing also use the external GPG for
signature verification.

In the signer use Bouncy Castle only to verify that the result we get
from the external program is indeed a correctly formatted signature, but
don't verify the signature. Previously we tried to fully verify the
signature, but for some GPG setups, the JGit implementation cannot find
the public key. For instance when GPG uses the keyboxd daemon (as
Gpg4Win does since version 4.2.0), it stores public keys in an sqlite
database.

Bug: egit-12
JGit-Dependency: I9cf093caa9fdebede801d665f2591cd9b275e1fd
Change-Id: I371b47b4d909635485f2a34e3bae8b104d831399