Bring in verify-release.sh. We mention using it in docs/releasing.md but don't have it in this repo. It should be adapted and stripped of Go specific things, as it was originally meant for Go projects.