Validate crypto signatures of binaries we download

[bobbrow]

Type: Compliance

[sean-mcmanus]

Our code may also download an insider vsix, so it seems like we'll want to add an integrity check for that later, maybe as part of #5856 changes.