validate downloaded archives

[pmiess]

Some sources publishes hashes or pgp signatures for an archive.
It would be nice to be able to tell 0template to validate them as it creates the feed.
This way we could be sure that the published feed is using the archive that upstream created.

[pmiess]

Because of #13, on windows, I cant manually validate it afterwards either without downloading it twice.
As an alternative a mode where 0template creates a feed based on a local archive and a source URL would allow the download and validation to be done in the 0watch script.

[talex5]

If the archive (with the same basename as the URL) is in the same directory as the template then 0template will already use that instead of downloading it.

[pmiess]

The watch script will need to check the feed for the current version and download the archive to the template directory if the file is new, to validate it and use that mode.