Support OSes with signed checksums (e.g. Debian, Ubuntu)

Nobody has claimed this yet.

**Is your feature request related to a problem? Please describe.**

I'm proposing here just a minor convenience feature.

https://osresearch.net/InstallingOS/ says:

> [For certain OSes](https://github.com/linuxboot/heads/tree/master/initrd/etc/distro/keys), Heads boot process supports standard OS ISO bootable media (where the USB drive contains the ISO installation media alongside of its detached signature) ...

The "certain OSes" list excludes Debian & Ubuntu: major distros popular with power users and casual users respectively.

**Describe the solution you'd like**

Instead of publishing (as Arch, PureOS, QubesOS, and Tails do) an ISO & a detached signature for it, Debian & Ubuntu publish:
- an ISO
- a checksum file for the ISO
- a detached signature for the checksum file.

It would be great if Heads:
- Adds the [Debian signing keys](https://www.debian.org/CD/verify) to [initrd/etc/distro/keys](https://github.com/linuxboot/heads/tree/master/initrd/etc/distro/keys)
- Adds the [Ubuntu signing keys](https://ubuntu.com/tutorials/how-to-verify-ubuntu#4-retrieve-the-correct-signature-key), too.
- Updates [initrd/bin/kexec-iso-init.sh](https://github.com/linuxboot/heads/blob/master/initrd/bin/kexec-iso-init.sh) to look not only for detached sigs (as at present), but also for checksum files with detached signatures: if found, then to verify the checksum file with the signature and verify the ISO with the checksum.

**Describe alternatives you've considered**
The alternative is for the user to manually verify the Debian or Ubuntu ISO - which they might not do, or might do incorrectly.

Heads verifying the OS installation ISO would increase assurance, reducing the risk of a user installing a corrupted or tampered OS.

Start with initrd/bin/kexec-iso-init.sh and the existing keys in initrd/etc/distro/keys; compare the current detached-signature handling with Debian and Ubuntu's verification instructions. Add the requested distro keys and support checksum files with detached signatures, then verify that both the checksum file and ISO are validated.

Written by the indexing model from the issue text.