rpm: Don't both verifying signatures and digests when reading RPM metadata.

supermin doesn't care, and there's a performance penalty for
doing it.

Thanks: Panu Matilainen