Issue #5: Don't trust signatures in cache

Since cache is primitive and is prone to collisions on file names,
we can't trust the computed signatures to compare cache and expected
artifact.
So we simply keep only URL->File association in cache, and re-checks
signatures when necessary.