SECURITY: Check SHA256 hash of the upgrade image before proceeding
any further.  Proceeding with the pre-install checks, which are
scripts uploaded by the user without doing any sanity checks is a
very bad idea.

Note that because we do not yet do any signing over the upgrade
images, this is not a big problem yet, as the operation is limited
to the system administrators only, but better safe than sorry.

While I'm there, also assert that the form did gave us a sha256
checksum, which is guaranteed by the form itself.
Eliminate stale comments.