Verify by default

[dlipovetsky]

I think verifying changes by default is nice to do after applying to a "live" environment. But it is probably a must after applying to an image, since that image is probably the beginning of a longer infrastructure deployment pipeline, and it's important to fail early.

Of course, having an escape hatch is a good idea. For that, I suggest --skip-verify=[true|false] flag.

[moshloop]

depends on #2