merge/pull: verify GPG signatures of commits being merged