Fix verification of package integrity via GnuPG (CVE-2018-12556)

[bernhardreiter]

This is a security related defect, described in detail at https://neopg.io/blog/yarn-signature-bypass/ and got CVE-2018-12556 assigned.

The current code still looks unchanged and it is assumed it still has this problem
https://github.com/yarnpkg/website/blob/3dd78bf17ae02ec2f03b899240869f943c30a0e5/install.sh#L49

In brief: It accepts signatures from all public keys in the default keyring that the user running the script is using. It would be better to make sure that only a signature by yarn's public key is accepted.

[bernhardreiter]

There is a report for the website repo already at yarnpkg/website#937
(which I hadn't noticed before).