Cargo should not download, compile and install unsigned code

[genodeftest]

cargo install currently downloads, compiles and installs unsigned code, probably even over an unencrypted connection. The only security measure at all is checking some package index. This behaviour is horribly insecure.

cargo should do better:

1. warn for every unsigned piece of software that it is unsigned (and thus horribly insecure to run)
2. don't allow to git checkout over unencrypted connections at all. Ever.
3. suggest (later version: require) crates releases to be signed by the crate author
4. use Web of Trust or PKCS to verify signatures; fall back to TOFU (trust on first use) after warning and confirmation by the user.

[steveklabnik]

This is basically a duplicate of rust-lang/crates.io#75