update: use PGP to authenticate status file and downloaded binaries