here should be the pubring.gpg, secring.gpg, trustdb.gpg of the producer

- these files are not being distributed
- we need to have at least public key of the updater to sign and address files to him