This is false, see the `stack solver` and `stack init --solver` commands. Currently it's using cabal's dependency solver under the surface, but there is work in progress (by multiple parties) to implement a new SAT-based solver, see: https://github.com/commercialhaskell/stack/issues/116
Even without --verify, stackage-update is providing a far more secure setup than what you get from cabal update today (since it downloads over SSL). I didn't want to make GPG configuration an impediment to people using this tool, thereby pushing them towards something even less secure.
Longer term, we need a better answer, most likely using a config file to state your preference, and eventually switching the default to --verify.