Add verification code to RC email

The script that generates an RC and an email gives a suggested command to download the staging repo. If could also suggest a short script to verify sigs and hashes like the following.

``` bash
for file in $(find . -type f -regex '.*\.\(pom\|jar\|gz\)'); do
echo $file
gpg --verify "$file".asc $file
diff -Z "$file".md5 <(md5sum $file | cut -d ' ' -f 1)
diff -Z "$file".sha1 <(sha1sum $file | cut -d ' ' -f 1)
done
```

Start with the script that generates an RC and its email, then review the existing command for downloading the staging repository. Add a short verification script covering signatures, MD5 hashes, and SHA-1 hashes for the listed artifact types, and confirm the generated email presents it correctly.

Written by the indexing model from the issue text.