commit-graph: verify catches corrupt signature