Add script to verify all merge commits are signed

trusted-keys is missing fingerprints for jgarzik/gmaxwell
This script seems to use bashisms, so better mark its interpreter as bash (it doesn't work here).