gpg-interface: check good signature in a reliable way