stage1: gpg verify and cache retrieved coreos image

why not something more modern?