Add explicit verify of signature on secondary's tree head

Since verification inside the sigsum-go client package is being removed. See https://git.glasklar.is/sigsum/core/sigsum-go/-/pipelines/917 and sigsum-go#19 (closed).