Trust hardening: implement real signature verification and canonical signed payloads

[veryCrunchy]

Summary

Harden trust-critical paths by replacing placeholder signature checks with real canonical signing and verification.

Scope

• Replace placeholder signature verification in PeerUP distributed messages.
• Replace placeholder admin trust-chain verification logic.
• Define canonical serialization for signed payloads.
• Add tests around signing and verification behavior.

Why

Current trust claims are stronger than the implementation in some critical paths.

Deliverables

• Real verification logic
• Canonical serialization rules
• Tests for valid, invalid, and tampered messages

Acceptance Criteria

• No trust-critical path uses placeholder verification.
• Signature validation is deterministic and tested.
• Admin trust-chain verification no longer accepts shape-only signatures.