opkg: initial implementation of package list signature verification