New signature checking for manifests

Can check against own public key or use 1 to many upstream public keys.
Changed deploy script to place the redhat CA cert in upstream directory and not duplicate the local candlepin CA cert
Changed the rpm to have the redhat CA cert in the upstream directory
Local cert is checked first on manifest checking
Upstream cert(s) are checked without regard to priority. Only one needs to pass.
Existing import tests should cover change as they use self-cert to validate.