Verify signatures for debug symbol tarballs separately.

Otherwise, due to the filename similarity, the debug symbols for TBB are
mistaken for the actual TBB tarball, messing up the sha256sum and
signature verifications.