you know you might want to get it verified
also, moved that whole block below the check-signature logic, so
we don't execute it if the directory is a fake.
(the recommended-versions logic is still executed before the signature
is checked; we should fix that.)
svn:r2131