Support OSes with signed checksums (e.g. Debian, Ubuntu)

[PeonyThePeon]

Is your feature request related to a problem? Please describe.

I'm proposing here just a minor convenience feature.

https://osresearch.net/InstallingOS/ says:

For certain OSes, Heads boot process supports standard OS ISO bootable media (where the USB drive contains the ISO installation media alongside of its detached signature) ...

The "certain OSes" list excludes Debian & Ubuntu: major distros popular with power users and casual users respectively.

Describe the solution you'd like

Instead of publishing (as Arch, PureOS, QubesOS, and Tails do) an ISO & a detached signature for it, Debian & Ubuntu publish:

• an ISO
• a checksum file for the ISO
• a detached signature for the checksum file.

It would be great if Heads:

• Adds the Debian signing keys to initrd/etc/distro/keys
• Adds the Ubuntu signing keys, too.
• Updates initrd/bin/kexec-iso-init.sh to look not only for detached sigs (as at present), but also for checksum files with detached signatures: if found, then to verify the checksum file with the signature and verify the ISO with the checksum.

Describe alternatives you've considered
The alternative is for the user to manually verify the Debian or Ubuntu ISO - which they might not do, or might do incorrectly.

Heads verifying the OS installation ISO would increase assurance, reducing the risk of a user installing a corrupted or tampered OS.

[tlaurion]

Old, incomplete, not reviewed PoC was done a while ago to be taken back from willing contributors. We could definitely push this forward tlaurion#30