upstream release

mark as adopted from vesath
add additional b2 checksum to verify multiple checksums worth of TOFU
cosmetic fixes, e.g. MIT isn't a custom label, add PGP key intended uid...