Don't sign/verify signature files, silently skip; and warn if we see an unexpected file type.  #20