fix: download celestia-app-maintainers key in verify signature script

[rootulp]

Closes #2664

Testing

On a Digital Ocean droplet that has no keys,

root@rootulp-quicksync:~# ./verify-signature.sh checksums.txt.sig checksums.txt
Downloading the celestia-app-maintainers public key...
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100   689  100   689    0     0   6270      0 --:--:-- --:--:-- --:--:--  6321
Importing celestia-app-maintainers.asc
gpg: key D469F859693DC3FA: public key "celestia-app-maintainers <[email protected]>" imported
gpg: Total number processed: 1
gpg:               imported: 1
Deleting celestia-app-maintainers.asc
Verifying the signature of checksums.txt.sig with checksums.txt
gpg: Signature made Tue Oct 10 13:25:06 2023 UTC
gpg:                using EDDSA key BF02F32CC36864560B90B764D469F859693DC3FA
gpg: Good signature from "celestia-app-maintainers <[email protected]>" [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: BF02 F32C C368 6456 0B90  B764 D469 F859 693D C3FA

[cmwaters]

utAck

I have a mac that is not able to run the linux binary

[rootulp]

It's not clear to me if we should backport this PR. I expect most users who use this script to land on it via the README.md link and both the README.md and the script will use the default branch (main) rather than a release branch so I think we don't need to backport.

[rach-id]

utAck.

Left unblocking comment

[rach-id]

What's the [unknown]?
Also, is there a way for the signature to be trusted?