Function verify_signature 

pub fn verify_signature(
    artifact: &[u8],
    signature: &[u8],
    pubkey: &[u8],
) -> Result<()>

Verify a single detached PGP signature.

artifact is the raw bytes of the thing that was signed. signature is the detached signature (ASCII-armored or binary). pubkey is the publisher’s public key in OpenPGP form (also ASCII-armored or binary).

Returns Ok(()) when the signature is valid, Err(...) otherwise. The error distinguishes between:

• signature-format problems (Error::SignatureFormat, Error::PublicKeyFormat),
• the RNP library not being loadable (Error::RnpLoad),
• RNP itself rejecting the operation (Error::RnpVerify),
• and a syntactically valid but cryptographically bad signature (Error::SignatureInvalid).

Backend selection

Prefers in-process RNP via libloading. If librnp cannot be loaded, falls back to gpg --verify (transitional). The fallback is gated behind the [verify_via_gpg] helper so it can be removed cleanly once rnp-rs lands.