Add a new mode: integrity-check
Presently only defined for bgrt.
I wasn't going to propose this because it's not quite finished and Ubuntu can't make use of it this cycle. But then @halfline actually suggested it after I'd written it, so let's discuss that here.