Add more method to verify tbb signatures besides gpg

See: why SHA-256 or MD5 not in download section