Better document how to verify PGP signature

Add text clarifying our unusual packaging of the PGP signature inside
a tar file.

https://github.com/krb5/krb5/commit/fa4138c7853487105ab3c54e6d176c45eaf8b065
Author: Tom Yu <tlyu@mit.edu>
Commit: fa4138c7853487105ab3c54e6d176c45eaf8b065
Branch: master
 doc/build/index.rst |   24 ++++++++++++++----------
 1 files changed, 14 insertions(+), 10 deletions(-)