In the event that a detached signature fails to verify, the code would continue trying to find other keys with the same key ID and eventually conclude that the signature was issued by someone unknown (ErrUnknownIssuer). With this change, the signature verification error would be returned instead. (Technically the last error if several keys had a matching key id and neither verified.) Fixes golang/go#8509. LGTM=bradfitz R=bradfitz CC=golang-codereviews https://golang.org/cl/125030043