stage1: gpg verify and cache retrieved coreos image

I would be happy with alpha fwiw, but that's fine, we can address that subsequently.