doc: Improve documentation about VALIDSIG
The claim that VALIDSIG is the same as GOODSIG is simply wrong.
Attempt to clarify it. Also, the paragraph about primary-key-fpr and
sig-version was weirdly re-ordered during the org-mode conversion in
65eb98966a569a91c97d0c23ba5582a9a7558de0; repair it.
- Signed-off-by: Daniel Kahn Gillmor <dkg@fifthhorseman.net>