verify-tag: share code with verify-commit