pub fn verify(raw: &[u8], key: &[u8; 32]) -> Result<Catalogue, String>
Check signature and shape. Does not look at the cache.