Hexr evidence package verifier

Drop the .hexr-evidence.zip here. Everything is recomputed on this machine: every row hash, every chain link, every signature against the trust root inside the package. No network, nothing installed, nothing to trust but the root certificate, whose fingerprint you can compare with the one the customer reads out of their own cluster.