Make get_signing_key() smarter, change download location.

Checks if exists before downloading, moved tmp location to hub so that
it too can be cached (in the event of no internet access).
Update cache_check logic, allow for image reuse with no internet.

Cache checking now checks on first run also for when a new Spoke is
started with an old hub. Also filled out logic to make sense for all
other combinations of $REFRESH_IMAGES and $CACHE_IMAGES.