Add note to README.md highlighting batch verification for reports.

[hdevalence]

Ed25519 signatures support batch verification. This means that users who download large batches of signed reports can efficiently verify the entire batch at once. Batch verification can be much faster than singleton verification. For instance, here's a graph from this post:

This speedup would not be possible using ECDSA.

There should be a note in the protocol description highlighting that batch verification of signed reports is possible.