### SUMMARY
The `get_url` module does file integrity checking and allows passing a SHASUM text file on a remote host over HTTP.  Typically, binaries and their hashes are stored together so while the integrity control works there is no verification that the binary and its corresponding SHASUM file has not be altered by a malicious actor.  Sometimes software providers will include a digital signature for cryptographically verifying the SHASUM file.  This is a feature request to support verifying digital signatures.

##### ISSUE TYPE
- Feature Idea

##### COMPONENT NAME
get_url

##### ADDITIONAL INFORMATION
Consider the software package Vault by HashiCorp.  It's a single binary in a zip archive precompiled for practically every common architecture and operating system.  It's used to protect secrets, so there is value in a threat actor modifying the code to install backdoors or other code to compromise or disclose those secrets.

HashiCorp is aware of this so they have a GPG key pair where the private key they keep secret and the public key they publish on their website and in all major GPG public key servers.  Whenever they create a new release, they SHA256 all of the binaries, put them in a SHA256SUMS file, and sign it with their private key.

I would imagine providing an attribute for `get_url` to specify the public key ID as well as the path to the digital signature.  For example:

```yaml
- name: Download vault
  get_url:
    url: https://releases.hashicorp.com/vault/1.4.1/vault_1.4.1_linux_arm64.zip
    dest: vault_1.4.1_linux_arm64.zip
    checksum: sha256:https://releases.hashicorp.com/vault/1.4.1/vault_1.4.1_SHA256SUMS
    checksum_sig: 51852D87348FFC4C:https://releases.hashicorp.com/vault/1.4.1/vault_1.4.1_SHA256SUMS.sig
```

Right now I have to download the SHA256SUMS file to verify the signature, and then I can't pass that file to the get_url checksum parameter because it only accepts the raw checksum or a URL; it would also be nice to pass a local path to this field and the hypothesized checksum_sig field.

These are the steps I am using to ensure the integrity and authenticity of Vault:

```shell
# Import HashiCorp's Public Key from the OpenGPG Public Key Server
$ gpg --keyserver keys.openpgp.org --recv-keys 51852D87348FFC4C
gpg: directory '/root/.gnupg' created
gpg: keybox '/root/.gnupg/pubring.kbx' created
gpg: /root/.gnupg/trustdb.gpg: trustdb created
gpg: key 51852D87348FFC4C: public key "HashiCorp Security <security@hashicorp.com>" imported
gpg: Total number processed: 1
gpg:               imported: 1

# Download all files
$ curl -Os https://releases.hashicorp.com/vault/1.4.1/vault_1.4.1_SHA256SUMS
$ curl -Os https://releases.hashicorp.com/vault/1.4.1/vault_1.4.1_SHA256SUMS.sig
$ curl -Os https://releases.hashicorp.com/vault/1.4.1/vault_1.4.1_linux_arm64.zip

# Verify signature
$ gpg --verify vault_1.4.1_SHA256SUMS.sig vault_1.4.1_SHA256SUMS
gpg: Signature made Thu Apr 30 08:20:29 2020 UTC
gpg:                using RSA key 51852D87348FFC4C
gpg: Good signature from "HashiCorp Security <security@hashicorp.com>" [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: 91A6 E7F8 5D05 C656 30BE  F189 5185 2D87 348F FC4C

# Verify binary hash
$ shasum -a 256 -c vault_1.4.1_SHA256SUMS
# ...
vault_1.4.1_linux_arm64.zip: OK
# ...
```
mtime = os.path.getmtime(dest)
        last_mod_time = datetime.datetime.utcfromtimestamp(mtime)
        
        
        if checksum_mismatch:
            force = True
    
    start = datetime.datetime.utcnow()
    tmpsrc, info = url_get(module, url, dest, use_proxy, last_mod_time, force, timeout, headers, tmp_dest)
    result['elapsed'] = (datetime.datetime.utcnow() - start).seconds
    result['src'] = tmpsrc
    
    
    if dest_is_dir:
        filename = extract_filename_from_headers(info)
        if not filename:
            
            
            
            filename = url_filename(info['url'])
        dest = os.path.join(dest, filename)
        result['dest'] = dest
    
    if not os.path.exists(tmpsrc):
        os.remove(tmpsrc)
        module.fail_json(msg="Request failed", status_code=info['status'], response=info['msg'], **result)
    if not os.access(tmpsrc, os.R_OK):
        os.remove(tmpsrc)
        module.fail_json(msg="Source %s is not readable" % (tmpsrc), **result)
    result['checksum_src'] = module.sha1(tmpsrc)