Sign our phars and check the signature when self-updating

[nicwortel]

We should cryptographically sign the distributed release-tool.phar so people can validate it. Also, we should check the signature in the self-update command (#44).