When passing `gpg.publicKeys` a `source` including _multiple_ keys, only the first one in `source` will have `trust` set correctly. This commit fixes the issue and adds a corresponding test (failing without the patch, fixed with it).
