code: def verify_signature(message_path: str,
                       sigfile_path: str,
                       cert_path: str) -> None:
      
      with tempfile.TemporaryDirectory() as pubkey_dir:
          pubkey_contents = subprocess.check_output(
              ['openssl', 'x509', '-in', cert_path,
               '-pubkey', '-noout'])
          pubkey_file = os.path.join(pubkey_dir, 'pubkey')
          open(pubkey_file, 'wb').write(pubkey_contents)
          try:
              verification = subprocess.check_output(
                  ['openssl', 'dgst', '-sha256', '-verify', pubkey_file,
                   '-signature', sigfile_path, message_path],
                  stderr=subprocess.STDOUT)
          except subprocess.CalledProcessError as cpe:
              verification = cpe.output
  
      if verification.strip() == b'Verified OK':
          LOG.info(f"Verification passed from cert {cert_path}")
      else:
          LOG.error(
              f"Verification failed with cert {cert_path}: {verification}")
          raise SignatureMismatch(f'Signature check failed')
docs: Verify the signature (assumed, of the hash file)
  
      It is assumed that the public key for the signature is in the keyring
  
      :param message_path: The path to the message file to check
      :param sigfile_path: The path to the signature to check
      :param cert_path: The path to the certificate to check the signature with
      :returns True: If the signature verifies
      :raises SignatureMismatch: If the signature does not verify