Allow enforcement of _all_ rather than _any_ signature matches.

[mikewest]

In #20, we discussed @ddworken's proposal to allow "Specifying two public keys, and accepting the resource if it is signed with both keys. This could be useful to enable only executing a script if it has a signature proving it comes from a specified authority (e.g. Google Analytics) and a separate signature proving that it was independently audited (e.g. by an independent security firm)."

Right now the proposal allows multiple keys, but accepts a match of any asserted key. It seems reasonable to consider giving developers the ability to change that behavior to enforce provenance requirements that are more along the lines of @ddworken's suggestion.

Filing this bug as a potential enhancement we should consider in the future as we get feedback from developers about how they're using this tool.