test index.jar signature checking
I got scared by seeing the Android docs' version of JarFile.getInputStream,
which didn't mention SecurityException or the signature checking. But it
seems that even tho its not in the Android docs, Android implements it the
same as Java does. It is good to have these tests in place anyhow, since
this is an essential piece of the security process of FDroid.