In some cases, we want to be able to install extra dependencies on-demand

instead of shipping everything with RBTools. The current example of this is

that we're pulling the TFS interface out into our own custom-written helper

(instead of making everyone download Team Explorer Everywhere), but it's too

big to just include in the egg.
With this new command, users can download and install said dependencies in one

command. This doesn't attempt to be a full-fledged package manager (there's no

versioning, or dependencies, or conflict resolution, etc), but it should be

good enough.
This does make some efforts to verify that the downloaded package is authentic.

If gpg is installed, it will check that the file is correctly signed.

Otherwise, it will check the sha256sum.

Used this a bunch while iterating on the TFS module. Checked that both

signature and sha256sum validation worked as expected.