Don't require .sig of downloaded packages

Don't require the packages .sig files, even in the case when the user let handling of verification on the default and haven't set anything.

Fix of #110 (closed). It is being compiled in dev-michal right now to test if it really works.