Extracts the commit object, resolves the identity's public key, and checks the archive's signature. Does not verify other archive contents.