libvirt: add possibility to verify image signature

[kayrus]

relates to #583
/cc @mischief I have this in my TODO list for a long time :)

[kayrus]

gpg --enable-special-filenames --verify <(curl -s http://stable.release.core-os.net/amd64-usr/current/coreos_production_qemu_image.img.bz2.sig) <(curl http://stable.release.core-os.net/amd64-usr/current/coreos_production_qemu_image.img.bz2 | tee >(bzcat > coreos_production_qemu_image.img))

[kayrus]

relates to #736

[kayrus]

https://coreos.com/os/docs/latest/verify-images.html

[euank]

Our libvirt docs now recommend doing a gpg --verify in the download section (part of #1119).