Something to try out: Quicklisp with OpenPGP and SHA verification