use gpgv to verify images and debian packages

[eighthave]

Debian now includes a static gpgv binary package so that chroot managers like Linux Deploy can easily verify things that have GPG signatures, like the debootstrap install process or signed image files. This means that Linux Deploy could do a fully verified debootstrap install like Debian does, and like Lil' Debi did on Android. Here's the key documentation on how:

• https://packages.debian.org/gpgv-static
• crouton's debootstrap call does not verify the packages it installs dnschneid/crouton#2362
• https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=806940