Verify digests on apply

[aaronlehmann]

Continuity does not currently verify digests during the apply operation. It should be changed to verify them by default. In case the data comes from a trusted source, such as a content-addressable store, there should be a --disable-digest option to override this default and avoid unnecessary hashing.

verify should continue to always verify digests.