Run configured package manager verify signatures

[timotheeguerin]

The initial implementation #6220 doesn't verify the signature of the downloaded package.

The concern is that corepack today include the registry keys in their codebase which means when rotated any older version is now broken(without passing the flag to ignore key validation) nodejs/corepack#616

Seems like a suggested solution is to use the npm approach to call tuf sigtool to retrieve teh keys with a fallback on downloading them from npm registry (with potentially logging a warning to the user)

npm implementation
https://github.com/npm/cli/blob/593c84921b0df963cef2ca7b13e44acc20cbd558/lib/utils/verify-signatures.js#L178-L191

[markcowl]

est: 5