Sign the images

The users should be able to easily verify that the image is authentic and not malicious (ex from a malicious mirror).

Related: infrastructure#272 (closed), blocked by: infrastructure#280

Edited by Kristian Klausen