Comment 2 for bug 1013681

I would welcome feedback on the alternative approach. The idea is basicly to simply download a signed keyring file, gpg verify that against the master key and if its good, import it.