attempting to download a version from the npm registry (or a mirror) that was published using the now deprecated PGP signature without providing a hash will trigger an error. Users can disable the signature verification using a environment variable.
Features
separate read and write operations on lastKnownGood.json (#446) (c449adc)