Add a bit to section 4.2 about how the conventional signature is verified

[danvangeest]

In Section 4.2 I think it is missing how the conventional part of the cert sig is verified. It talk about the alternative sig verification, but I don’t see that how the conventional sig is verified. Even if it out of scope we should have a sentence to spell it out for clarity. Also we should explicitly say if the pq part of the cert does not verify but the conventional sig does, if the cert verification fails completely. Similarly if the alt sig verifies, but not the conventional, we need to spell out if that is a verification failure.