Change semantics of is_verified? when argument is passed.

If the argument to Document#is_verified? is Hash-like (something
which implements #[]), then we assume the caller is passing a
store of certificates (keyed by the fingerprints of their public
keys), some portion of which are expected to match the keys
embedded in the document. If the store does not contain all the
keys embedded in the document, then verification must fail. In this
way the caller can ensure the document is signed with trusted keys,
even if it can't be determined before calling which of those keys
were used. However, the document must contain all the keys used
to sign it, which is not required by the spec. It remains to be
seen whether this limitation is too severe.

If instead the argument is Certificate-like (something which
implements #public_key), then the public key of the argument is
used to verify all signatures in the document. The document need
not contain keys, nor must any keys it contains match the
passed-in key. This is useful when the (one) key which signed the
document is known before calling.

If no argument is passed, then the document must contain the keys
used to sign it.