store.verify should assert that the path it is verifying is normalized

Review pls, @garrettr !

See the comment about the possible vulnerability in `verify`.