Add verification for downloads of update.sh

Before, during the build process, packages were downloaded over http
without authentication. Now, the Release file and packages are properly
verified. If verification fails, a warning will be presented to the
user with the option to ignore it.

Note that in order to perform GPG verification of the Release file, the
user must have the Raspbian signing key in their keyring. The key can
be obtained from public keyservers (0x9165938D90FDDD2E) or from
https://archive.raspbian.org/raspbian.public.key.

Edit: I added another commit to use the Release file to check the available compression formats instead of using `wget --spider`. These two commits should resolve #55.

Note that I made the assumption that the last checksums in the Release file are SHA256 sums, which is true now but may change in the future.