Create mechanism for committing hashes/checksums of published binaries to repos, and verifying them on install

node-pre-gyp currently has no mechanism for detecting a situation in which a built binary has been tampered with on s3 since its initial publication. We should have a way, after publishing a binary or set of binaries, to commit a hash (potentially signed, but might not be necessary) of the published binary to source control, publish it to npm, etc. This hash can be checked at node-pre-gyp install time, and can fail if a file on s3 has been tampered with.

For repositories that build and publish automatically on CI infrastructure in a single step as part of a release, we'll have to think about how these hashes would best make their way back into the repo. Maybe we can come up with best practices for producing them as build artifacts of some kind?

cc @mapbox/security @flippmoke

Start by reviewing node-pre-gyp's publish and install flows, including how published binaries and CI release artifacts are handled. Determine where checksums would be recorded and verified, and define completion as a documented mechanism that detects tampered binaries during installation.