Unable to securely add repositories

[Stuart Bishop]

charmhelpers.fetch.add_source() allows you to provide a GPG key id, but this is pointless as there is no way to securely retrieve a GPG key from a remote keyserver. If an attacker is in a position to intercept requests to an archive, they are also in a position to provide a fake keyserver.

My understanding is that you must have the actual GPG key (rather than the keyid) to securely add a repository. add_source() needs to be extended to accept full keys in addition to key ids to allow charms and operators to do so.