This way, we can make it clear that there are two methods to verify an ISO,
while previously we had three methods (2 for ISO images and 1 for IUKs)
following each other ⇒ better semantics.

While I'm at it, point to the doc for building IUKs as one can't verify
something they have not built in the first place.