Provide a way to verify Keybase app download integrity

When you go to download the Keybase app it would be nice if there was a way to verify the integrity of the download.

The Tor Project serves as a good example of this. They provide signature for each of their downloads and clear instructions on how to verify the integrity of the download ([Downloads with signatures](https://www.torproject.org/projects/torbrowser.html.en), [Verification instructions](https://www.torproject.org/docs/verifying-signatures.html.en), [Signing keys page](https://www.torproject.org/docs/signing-keys.html.en)).

Start with the Tor Project reference links in the issue and inspect the existing Keybase download flow; no file or test is named. Done means downloads have an integrity-verification mechanism and clear instructions, including the relevant signing keys.

Written by the indexing model from the issue text.