imagebuilder: add package signature verification