add Checkey from Guardian Project using verified build and upstream key
This includes the new verification process where the upstream's APK signature is used in the f-droid.org repo. This works on my machine using fdroidserver
commit 2a87ae51278f590453cbab6adc15db79bfd1dc97.