Extract an archive's commit object, resolve its public key, and verify its signature.

No pipelines have been run yet.