store.verify should assert that the path it is verifying is normalized

Review pls, @garretr!

See the comment about the possible vulnerability in `verify`.