add the --verify option

This is the second attempt at #535 - this time targeting the gulp 4 branch. I think I've tackled all the comments left in the original PR (#668) 
@pkozlowski-opensource i don't trust TJ projects on principal, but a project I follow, harp, had to gut superagent from all the tests because there was a bug that wouldn't get fixed. Never tracked it back to which issue, but just increases my distrust.  Let's use https://www.npmjs.org/package/wreck - the hapi team is awesome and its dependency tree is small.