Add script to verify all merge commits are signed

trusted-keys is missing fingerprints for jgarzik/gmaxwell
Ehh, almost all shells people use support functions, not sure which one(s) dont at this point.