Reorders some of the operations related to RRSIG validation.  The net
effects here are that the code performs all of the parts of validation
that are not specific to the keys first before the parts that are
specific to keys (and need to be repeated for each key).

This also fixes the inconsistency that if there are multiple keys that
match an RRSIG, a single malformed key would lead to an exception, but a
signle failed signature validation would not.  In both cases, an
exception should only be raised if no keys successfully validate the
RRSIG.

Raise an error if the number of labels in the signature is longer than the
number of labels in the owner name.  (This is just to give a better error
as the validation would fail anyway.)