it can happen that no package signatures are available: if this is the case, completely skip the signature verification.