Add signature verification to the tox update script

[pganssle]

All the official IANA releases are signed by Paul Eggert's keys. We should verify the tarballs against the equivalent .asc files as part of the update process.