Install script should check for expected GPG subkeys

[Daniel15]

See yarnpkg/yarn#5223

Currently it just checks for the main GPG key, but that doesn't handle if we've recently rotated the subkeys. It should check that the proper subkey is present, too.

[cormacrelf]

FYI, this is still happening. https://travis-ci.org/cormacrelf/angular-skyhook/builds/415030644

That CI has been installing yarn via install.sh for about a month.

Edit: I restarted the build and #855#339.0's logs are gone, but it was the GPG signature for this Yarn release is invalid! This is BAD... message. The mismatch seems to have gone away. But it did tell me to report it, so there you go.

[Daniel15]

I don't think that's the same issue that was covered here. Please open a new issue if you still see this. Note that ideally you should use Docker for system-wide dependencies such as Yarn, rather than installing it fresh on every single build. It'd speed up your builds, too :)