add switch to always verify the masters pubkey

for the paranoid among us, this makes it possible to always verify
the masters auth-replies, even if the public key has not changed
verifying the signature does not mean its always a new key
both sides have to either sign (master) or verify (minion)

it shall not be possible, to have the master sign its auth-replies without
having the minion verify the signature and vice versa.
minor update in the comments