Add checking for signature hashes

  Signatures include the first 2 octets of the hash the signature is
  over. Checking this matches what we expect is an easy way to drop
  corrupt or incorrect signatures. It doesn't provide any cryptographic
  verification but is a useful sanity check when accepting keys.