Add script to verify all merge commits are signed

trusted-keys is missing fingerprints for jgarzik/gmaxwell
I'm not sure it is either, but its easy enough and for completeness it should be there.