Add log messages that indicate what is being verified

[edsko]

although we will then probably want to distinguish between log messages shown at -v, which tell us about stuff that went wrong, and log messages that tell us about what's happening during a normal security check, maybe shown at -v2.