Fix #254 - regression where TOFU repos were not working.
The code for promoting an untrusted repo with no fingerprint, to
a repo with a pubkey and a fingerprint, was still there. The problem
was that it was being executed after we verified the index.jar cert
against the pubkey stored against the repo (which is empty for TOFU
This change makes it so that if we are updating a repo without a
fingerprint, then it is a TOFU request, and we don't try to verify