Use gpgverify macro instead of explicit gpgv2 command. Move .sig file to sources instead of dist-git.