Always use GPG fingerprint instead of key ID

[sebastianheuer]

The key ID is not a reliable criteria for validating GPG keys: http://www.golem.de/news/keyserver-chaos-mit-doppelten-pgp-key-ids-1608-122733.html

[theseer]

To clarify this a bit:

As it looks like GnuPG only returns the long key id in --verify operations:

[GNUPG:] BADSIG 9D8A98B29B2D5D79 phar.io <team@phar.io>

[GNUPG:] ERRSIG 4AA394086372C20A 1 10 00 1405769272 9

So we only have the (long) key id to search with at the key servers.
We already show the fingerprint when asking to import the key into the keyring.

But since the key id might not actually be as unique as we thought, there might be multiple keys matching. Phive needs to get enhanced to handle this situation and iterate over candiates.