the rugged versions up to 0.26.0b3 had a bug concerning the signature
extraction. The extracted signature was not always the same, probably
due to a buffer (overflow) issue in libgit.

see https://github.com/libgit2/rugged/issues/608

we introduced memoizing, so it's safe to call the method multiple times.

we need to store the keyid to be able to update the signature later in
case the missing key is added later.

as we write the cache in the gpg commit class already the read should
also happen there.

This also removes all logic from the main commit class, which just
proxies the call to the Gpg::Commit now.

we store the result of the gpg commit verification in the db because the
gpg verification is an expensive operation.