Check that v6 signatures are made by v6 keys

[andrewgdotcom]

RFC9580 requires that v6 signatures can only be made by v6 keys. This condition was inserted to keep the space of possible combinatorics under control. It should be checked as early as possible, and invalid issuers rejected.