Verify package signatures