bb#11135 - sigtool now verifies cvd prior to unpacking