Add verification for downloads of update.sh

Before, during the build process, packages were downloaded over http
without authentication. Now, the Release file and packages are properly
verified. If verification fails, a warning will be presented to the
user with the option to ignore it.

Note that in order to perform GPG verification of the Release file, the
user must have the Raspbian signing key in their keyring. The key can
be obtained from public keyservers (0x9165938D90FDDD2E) or from
https://archive.raspbian.org/raspbian.public.key.