Trust external plugins

We want to make external plugins available via our plugin repository (the external plugins remaining hosted on external servers). For this we need a mechanism that allows us to trust that a given version of a plugin is not corrupted (whether intentionally or not), that is that the contents of the egg file do not change. Once a given version of a plugin has been checked as stable and righteous, it should not change ever.

The idea is to perform an integrity check on the egg once it is approved for listing in the repository, e.g. a simple md5 checksum, and compare this sum client-side before attempting to download the egg.