Start support for verifying signatures inside debs
Laxy parsing of debian packages
Calculate hashes on the fly
Parse and validate signatures
Optionally only validate debs if changes not valid

 - Add some extra docs for deb.go
 - Add an otpion vlidatedChangesSufficient, we wont validate dpkg
   signatures if a changes file was signed