Bug 30480: Check that a signed tag object contains the expected tag name

When checking the signature on a tag, we also need to check that the tag
is really the expected tag in order to avoid rollback attacks.

Thanks to Santiago Torres-Arias and Keving Gallagher from NYU for
reporting and helping to fix this issue.