Provide instructions on verifying releases (#399)

Provide instructions on verifying signatures

Note this is quite lengthy / hand wavy, but I believe
its better we show how our trust model works.

I also point out how much of this will be streamlined and improved
via the TUF integration

Signed-off-by: Luke Hinds <lhinds@redhat.com>