Add a note about downloads and pgp verification to the readme