Extract an archive's commit object, resolve its public key, and verify its signature.