feat(coreos): add gpg

the installer uses GPG to verify digests. Other people can and should use gpg
to verify stuff they download to the host.