main
download: explicitly check GPG exit status after copy (CVE-2021-20319)
download: test signature verification in fetch pipeline
io: add zstd decompression support
io/verify: add unit tests