in cli/verify.go [45:67]
func verifyImageSigsStr(img image.Image, keys []sec.PubSignKey) (string, bool) {
	prefix := "signatures: "
	sigs, err := img.CollectSigs()
	if err != nil {
		return prefix + fmt.Sprintf("BAD (%s)", err.Error()), false
	}
	if len(sigs) == 0 {
		return prefix + "n/a", true
	}
	if len(keys) == 0 {
		return prefix + "not checked", true
	}
	idx, err := img.VerifySigs(keys)
	if err != nil {
		return prefix + fmt.Sprintf("BAD (%s)", err.Error()), false
	}
	return prefix + fmt.Sprintf("good (%s)", OptSignKeys[idx]), true
}