leap_bundler: verify gpg signature for tags

It would be nice if the leap bundler can verify the signature of the tags that it uses for the bundles.

(from redmine: created on 2015-01-21, closed on 2016-05-04)