Signed-off-by: Christian Heusel <christian@heusel.eu>

This avoids the issue of ending up with a HTML page that contains a
redirect link if we are not hitting the final endpoint with the
retrieved link.

Sequoia now manages the trust level, so we need to add the fingerprints
and mark those keys trusted before verifying the file.