[Security] git verify-commit everywhere

Introducing a script https://github.com/rootzoll/raspiblitz/pull/2683/commits/d51440216436acbf82f16e4728f29b3ea0ec1fca to verify the checked out git commits with the BTCpay update: https://github.com/rootzoll/raspiblitz/pull/2683

All scripts installing services built from the source code can have a header like:

PGPsigner="nicolasdorier"
PGPpubkeyLink="https://keybase.io/nicolasdorier/pgp_keys.asc"
PGPpubkeyFingerprint="AB4CFA9895ACA0DBE27F6B346618763EF09186FE"

and can run:

# pin version
sudo -u $installingUser git reset --hard $version
# PGP verify
sudo -u $installingUser /home/admin/config.scripts/blitz.git-verify.sh "${PGPsigner}" "${PGPpubkeyLink}" "${PGPpubkeyFingerprint}" || exit 1

to reduce trust in the download source.

Failing to verify the PGP signature on the checked commit breaks the installation.

Can implement this on all services as we go on applying the pinned updates.

[rootzoll]

PR merged for final testing

[rootzoll]

Works so far good with RCs … closing foir release.