Perform tarsum verification on image pull

Verify the tarsum on pulling images from the registry.
Perhaps this should be called TarSumCheckReader.