Add script to verify all merge commits are signed

trusted-keys is missing fingerprints for jgarzik/gmaxwell
Why 2x 'HEAD' ?