doc/installation: explain how to verify the integrity of tarballs

I have signed the tarballs at http://code.halmd.org/tar with a trusted
X.509 certificate.