Sign packages and verify signature on install

Nobody has claimed this yet.

Currently packages are just placed on S3 and the bucket restrictions are the only guarantee that the packages is not modified by a third-party.

In almost all cases we only want the build server to be able to place pre-build binaries there. If a third party modifies the package on purpose or by accident we want to know about this.
Similar if the package is modified in transit (MITM) we want to be able to detect that.

The usual way of doing this is through signing packages (or rather the checksum). This is a mechanism that is implemented in almost every package manager, for the reasons above.

Technical challenges:
1. Each publisher (read CI of a repository) needs its own GPG key.
2. Each client needs to know about the public GPG key of the publisher to verify the signature.
3. The client needs to obtain the public key from a trusted source

Possible solutions:
1. Store private GPG key in secure variable in travis and import on publishing.
2. Assume public key is bundled in NPM package.
3. Bundled with the published `npm` package: Assumption you trust the npm -> client transport: We do so anyway otherwise you could just change the S3 path in the package.

/cc @mikemorris

Start by tracing how node-pre-gyp publishes pre-built packages to S3 and how clients install them. Review the proposed CI GPG key handling and how a trusted public key could be bundled with the npm package. Done means published packages are signed and installation detects modified packages.

Written by the indexing model from the issue text.