merge: extract verify_merge_signature() helper