More code path test coverage

Added test coverage for untested code paths (mostly error handling) revealed by 'go tool cover'.
How about just:

    cloneErr := primary.Clone().Verify(rootKey, check, discharges)
    c.Assert(cloneErr, gc.DeepEquals, err)

?