use check-local-archive-file instead of our verify-download?

[bo-tato]

I realized quicklisp already has a check-local-archive-file that is documented as verifying size and signature of downloaded files but actually only checks the size, not the signature. It does report better error information than we are reporting in verify-download, and when the check fails it offers a restart to "Delete the archive file and fetch it again". I'm thinking maybe instead of having our own verify-download function, we should just add the the md5 and sha1 signature checks as CLOS :after methods to check-local-archive-file, and the existing function will do the file length check. If that sounds reasonable I can make a PR for it

[rudolfochrist]

Yes. Sounds indeed reasonable. Please go ahead and create PRs for this.