Check package hashes and signatures (optionally)

[XVilka]

• Check package hashes to ensure if the download was proper
• Check package signatures when option is set

[ret2libc]

This is already done for the sources. If you see the rz-pm-db repository or the example in the read me you see there is the hash and there are also unit tests to check that installation fails if it doesn't match

[ret2libc]

The signature part is not done though.

[ret2libc]

Check package hashes to ensure if the download was proper

Works with v0.1.0