835977: Re-enable manifest signature checking.

The production/stage public candlepin certificate is now packaged in the
RPM. This is flagged as a config file but *without* noreplace, so any
deployment using their own upstream cert (we don't think there are any)
will have to restore it from the rpmsave file that results after a
candlepin rpm upgrade. This was done because we expect this to be the
desired behavior, there is no known usecase for using your own
upstream cert at this time.