Clarify how to handle third-party signatures on components

Currently, SignedUser::verify and SignedUserAttribute::verify will error based on the properties of third-party certifying signatures. It's unclear what exactl semantics would be best for callers of these functions, but at least clarification would be good.

Also see #448, which was one (abandoned) train of thought about handling it.