Also look up keys by KeyID in findSigner()

Depending on the signature's validity, fingerprint() may actually be a
keyid.

(cherry picked from commit 4b6fa69faaafd0ec7b89999be5a5c09c1b514850)