publish index-v1.json and include a gpg signature

This gives a more flexible and direct way for many clients to consume the index file. #969 (closed)