Verify artifact checksum

cc @opscode/release-engineers 
I wonder if we should call these `local` and `remote`? expected/actual seems confusing.