Verify every kubectl download against a pinned checksum (#2351)