depends: use --no-verify by default