update: put pgp key in its own header (and update the key to 2008), put a FIXME for some bug discovered (some signatures are smaller than 65 bytes), be more verbose when a problem happens.