Verify a hash-based signature