Iterate over signature not keys to allow empty signatures array in case ...

...the message has no signatures.

When calling `openpgp.decryptAndVerifyMessage` on a message that has no signatures, the signatures array was not empty because `message.verify` iterated over the public keys in the outer loop. This fixes that issue.