1/ pgp v4 signature checks of status files with more than 506 bytes would fail
2/ pgp v4 signature checks would fail (code dupication sucks).

This code is quite a mess. We shouldn't need to implement all this lowlevel stuff. I'll remove most of it and use pgpme instead.

For the time being, this means that upcomming releases should use v3 signatures for the downloaded files and shouldn't use status files of more than 506 bytes (or maybe shouldn't use v4 signatures for status files either)