Without this, the only way to build PKGBUILDs with signatures is to pass --skippgpcheck to makepkg. Also switched to a package with PGP keys to verify.
Also update CI workflow to test against a package with multiple source files. This fixes https://github.com/heyhusen/archlinux-package-action/issues/31
Otherwise packages depending on multilib stuff can't be built.