Perform tarsum verification on image pull

Verify the tarsum on pulling images from the registry.
perhaps layerProgRdr? something in camelcase would be better.