Add script to verify all merge commits are signed

trusted-keys is missing fingerprints for jgarzik/gmaxwell
You're requiring both parents to be signed? In case of a merge commit the second one won't be, I think? Also, how many recursion levels does bash support?