Add script to verify all merge commits are signed

trusted-keys is missing fingerprints for jgarzik/gmaxwell
You can use:
```
git -c "gpg.program=${DIR}/gpg.sh" command [args]
```
instead of
```
git config gpg.program "${DIR}/gpg.sh"
git command [args]
```