[crux-devel] pkgmk source verification is not always needed