release doc: add a command to verify signatures