Add the concept of signed channels and review signed and unsigned OS images

[davidcassany]

We should distinguish between signed and unsigned channels and also check signatures for the images within the channel as part of the ManagedOSVersion resource reconcile loop.

Then, if we keep track of resources signatures we could consider enforcing signed resources matching some trusted signatures set.