[contrib] gh-merge: Move second sha512 check to before signing