Enable gpg subkey trust in signature verification
Enable gpg subkey trust in signature verification

in_toto.metadata.Metablock's signature verification function used
to fail if the passed verification key's keyid did not match any
of the signatures contained in the Metablock's signature property.

This commit extends the verification to also iterate over
optional subkeys contained in the passed verification key.

The entire keybundle is then passed on to the gpg verification
function, where it extracts the matching key or subkey to
verify the signature.

secure-systems-lab/securesystemslib,secure-systems-lab/securesystemslib