Verify keys.json before allowing package signing