stage1: gpg verify and cache retrieved coreos image

(e.g. once the next systemd rolls in)