Handle GitHub releases with multiple signatures

[lkrms]

This fixes phive install doctum, at least, but I'm not sure how common releases with multiple signatures are; it may be worth incorporating the same fix into other repositories?

[theseer]

I'll try to incorporate that hopefully next week.

[lkrms]

Sounds good. Would you like me to replicate the fix for other repositories?

Also, the QA failure looks like the same issue I had getting a test environment working--the version of PHPStan in phive.xml is too old to appear in the first page of GitHub's release endpoint response. Easy fix is to update phive.xml; less easy fix is to incorporate paging into PHIVE's HTTP client.