Also put back certificates on software release url.

This is the only remote url which is going to be trusted outside of buildout.

Fetching list of keys over the network from non signed url has no sense.

This version forces h.r.download to clean its own mess in /tmp.