Removed hardcoded SHA-256 digest in verfications; corresponding tests added

Now the checksum verification functions read all provided digests from
the file (manifest or signature file). If at least one matching digest
is found, the verification is considered OK.