verify-tag: also grok CR/LFs in the tag signature