Bug: PGP signature verification fails for Terraform 1.14.9 — `openpgp: key expired`

## Description `tfswitch` fails to install Terraform `1.14.9` due to an expired PGP key (`72D7468F`) embedded in the tool. The verification step downloads the SHA256SUMS signature file, attempts to verify it, and fatally errors out, making it impossible to use any version of Terraform signed with this key. This is a **blocking issue for CI/CD pipelines** as well as local development. ## Reproduction ``` tfswitch 1.14.9 ``` or via `.terraform-version` / `required_version` constraint resolution (e.g. `~> 1.1` matching `1.14.9`). ## Error output ``` INFO Verifying PGP signature of checksum file: "...terraform_1.14.9_SHA256SUMS" ERROR Could not verify PGP signature: Signature Verification Error: Invalid signature caused by openpgp: key expired INFO Deleting "...terraform_1.14.9_SHA256SUMS" INFO Deleting "...terraform_1.14.9_SHA256SUMS.72D7468F.sig" FATAL Error downloading: Signature of checksum file could not be verified ``` ## Affected environments | Environment | Details | |---|---| | macOS (arm64) | `darwin_arm64`, tfswitch `1.14.9` | | Linux (amd64) | `linux_amd64`, GitHub Actions runner (`ubuntu-latest`) | ## Logs **macOS (local)** ``` 22:07:55.451 INFO Verifying PGP signature of checksum file: "/Users/RS6399/.terraform.versions/terraform_1.14.9_SHA256SUMS" 22:07:55.453 ERROR Could not verify PGP signature: Signature Verification Error: Invalid signature caused by openpgp: key expired 22:07:55.454 FATAL Error downloading: Signature of checksum file could not be verified ``` **GitHub Actions (linux/amd64)** ``` 19:51:59.602 INFO Verifying PGP signature of checksum file: "/home/runner/.terraform.versions/terraform_1.14.9_SHA256SUMS" 19:51:59.602 ERROR Could not verify PGP signature: Signature Verification Error: Invalid signature caused by openpgp: key expired 19:51:59.603 FATAL Error downloading: Signature of checksum file could not be verified ``` ## Root cause hypothesis The PGP public key `72D7468F` bundled in the `tfswitch` binary has expired. HashiCorp periodically rotates their signing keys. The embedded key needs to be updated to the current valid HashiCorp signing key. The signature file requested is `terraform_1.14.9_SHA256SUMS.72D7468F.sig`, confirming the key ID in use. ## Expected behavior `tfswitch` should successfully verify the checksum file and install the requested Terraform version, or at minimum fall back gracefully (e.g. checksum-only verification without PGP) with a clear warning rather than a fatal error. ## Suggested fix - Update the bundled HashiCorp PGP public key to the current non-expired key - Consider fetching the public key dynamically from HashiCorp's keyserver or `https://www.hashicorp.com/security` to avoid this class of issue in the future - Alternatively, expose a `--skip-pgp-verify` flag (or `TFSWITCH_SKIP_PGP` env var) as a documented escape hatch for environments where PGP verification is handled externally ## Workaround None currently available without patching the binary or switching to an alternative install method (e.g. `hashicorp/setup-terraform` GitHub Action).