Verify artifact checksum

cc @opscode/release-engineers 
The `local` and `remote` I mentioned in the last review were actually in the message output so the user better understood what was happening. :smile: