so yes, a pgp-signed source tarball