Refuse a signature made when its key was not valid (closes #209)

verifySignature lets a key that has expired since verify a signature,
because a manifest outlives its key, but it checked the key only as of
now. It accepted a signature dated after its key expired, after the
key's self-signature or the signing subkey's binding signature expired,
or before the key was made. It now verifies a second time with the
library's clock set to the signature's creation time and refuses the
signature if the key or subkey was not valid then. docs/FORMAT.md
states the rule.

Judgement call: the tests make the refused signatures with the
library's packet API, because openpgp.DetachSign will not sign with a
key that is not valid at its clock's time.

Model: opus-5-5

docs/FORMAT.md

@@ -174,9 +174,16 @@ also refuses a manifest whose `signingPubKey` holds a DSA key or subkey, or any
 secret key or subkey, since checking the self-signatures of a DSA key or the
 numbers of a secret key can take hours when those numbers are very large.
 
-A signing key that has expired does not make the signature bad, because a
-manifest outlives its key. A signature past its own expiry time is not good,
-whether or not the key has expired too.
+A signature is good only if the key that made it was valid at the signature's
+creation time. The primary key is judged by the newest self-signature on its
+primary user ID, and a subkey by its newest binding signature. By the
+signature's creation time the primary key and that self-signature must have been
+made and neither may have expired, and when a subkey made the signature the same
+holds of the subkey and its binding signature. A signature made before that
+self-signature or binding signature is not good, even if an older one made the
+key valid at that time. A key that has expired since does not make the signature
+bad, because a manifest outlives its key. A signature past its own expiry time
+is not good, whether or not the key has expired too.
 
 ## Deterministic Serialization