Add signature verification via signed_xml.

Update version to 4.0.0.alpha.1, as this breaks compatibility (users
must now configure the new Issuer setting verify_signatures).

Update dependencies, including rspec and fakeweb. Saying
`rake check_dependencies` should now tell you exactly what gems are
needed for runtime and development.
Update .gitignore so jeweler will actually release this thing!