t: add tests for pull --verify-signatures