Is there a straightforward HOWTO somewhere on how to use gpg to verify downloads when a sig is provided?