working around shortings in PGP

...in particular, we only get to see 4-bytes of fingerprint in the case of a sucessful signature verification for a key that we know.  That problem is that we might easily see a collision in that case.  Our solution is check after the fact that there isn't a collision in the key ring.