Factor _verify_signature_with_pubkey; always prefer x509 even if key value is present