[RCU] publically verifying roundcube-provided gpg key?