Signed-off-by: David Runge <dvzrv@archlinux.org>

While not using `use_latest_tag` or `include_prereleases`, doing a lot
of requests without a token can still make GitHub complain. Just
treating it like a regular `git` repository without any GitHub magic
should circumvent this.

Switch to upstream provided sources and signatures since PyPI YOLO removed their signatures:
https://archlinux.org/todo/fix-reproducibility-of-packages-broken-by-pypi-removing-signature-files/
Consolidate dependencies.

Switch to PEP517.

Add python-{pyjwt,yaml} as new dependencies.
Remove prepare(), as upstream fixed the issues with reproducibility.

Remove __pycache__ dirs for reproducibility:
https://tickets.metabrainz.org/browse/PICARD-2362
Simplify quoting in file.
Simplify installation in package() to adhere to python package guidelines.

Add upstream's new PGP key (detached signatures are now available for the sdists on pypi.org).