This is the library to harden sources.lists
using the recommendations from https://wiki.debian.org/DebianRepository/UseThirdParty (for all the sources).
- Binds every source to its public key.
- If a file is present, uses the file
- Otherwise uses key fingerprint.