Consider validating download with GPG

[ryanaslett]

packer.io publishes their GPG key (https://www.hashicorp.com/security.html) and also puts out signed SHA256 hashes of each release (https://releases.hashicorp.com/packer/1.1.3/packer_1.1.3_SHA256SUMS & https://releases.hashicorp.com/packer/1.1.3/packer_1.1.3_SHA256SUMS.sig)

It would be good thing to compare the SHA256 against the downloaded file, and verify the SHA256 with gpg to ensure that 'what is being installed' is exactly what packer.io is delivering, and has not been MITM'd etc.