fix: add GPG key for the box phar file