Feature request: Verify upstream GPG signature

[alexhaydock]

Looking at the Snapcraft.yaml file, it doesn't look like there's any verification going on here for the fetched .deb file. For a security-focused application (or really any application) I think it would be a good idea if we verify the deb package as it gets pulled into the Snap build.

Does it make sense to include a gpg --verify step in the override-build: section?

Signing keys: https://updates.signal.org/desktop/apt/keys.asc

[alexhaydock]

Actually, doing this is a bit more complex than I thought so I posted a forum thread here with some suggestions.

[jnsgruk]

Hi - this isn't really relevant anymore, since we're building the application from source, so you're able to check exactly what's being built. Closing for now, thank you!