Add dependency verification

stacks on top of !40 (merged)

in case of future dependency changes, just run the corresponding gradle tasks adding --write-verification-metadata pgp,sha256 help --export-keys which will add the updated checksums and keys if present and retrievable.