attach-signature flow moved to digest-only verification semantics

[olszomal]

Pull Request Type

• Bug fix
• New feature
• Code style / formatting / renaming
• Refactoring (no functional or API changes)
• Build / CI related changes
• Documentation
• Other (please describe):

Related Issue

Fixes #491

Current Behavior

• attach-signature used full verification (including signature validation).
• Failures could depend on external verification setup (CA/CRL/TSA).
• Output file was kept even if verification failed.

New Behavior

• attach-signature uses digest-only verification.
• Verifies only content/digest consistency with PKCS#7.
• Output file is removed if digest verification fails.

Scope of Changes

• Added digest-only mode to verify_signed_file().
• PKCS#7 extraction logic refactored into helper functions.

Testing

• Existing tests
• New tests added
• Manual testing

Additional Notes

License Declaration

• I hereby agree to license my contribution under the project's license.

[mtrojnar]

verify_flag seems vague. What about verify_signature?