show if package is signed by f-droid or by upstream