Docker: verify GPG keys

[Raimo33]

I propose verifying the GPG keys for the bitcoin core and all other binaries.
https://github.com/ElementsProject/lightning/blob/master/Dockerfile

This can be done by hardcoding them as ARGS in the Dockerfile or by having a gpg/ dir.

[Raimo33]

it would look something like this:

WORKDIR /opt/bitcoin

ADD $BITCOIN_URL/$BITCOIN_TARBALL  .
ADD $BITCOIN_URL/SHA256SUMS        .
ADD $BITCOIN_URL/SHA256SUMS.asc    .
COPY gpg/bitcoin/                  gpg/

RUN gpg --import gpg/* && \
    gpg --verify SHA256SUMS.asc SHA256SUMS && \
    sha256sum -c SHA256SUMS --ignore-missing

RUN tar xvf $BITCOIN_TARBALL --strip-components=1