Fixed a typo walking the keylist during tag verify.

Found check-commit-signature when looking for alternative 
signature-verification hooks, and saw this small typo which should
have broken the check to see if a tag's signature is from a trusted key.

Note, I haven't gotten so far as to actually run 
check-commit-signature, so this fix is untested, but it looks
obviously correct.