fix: 400 for invalid end role signatures

[iFergal]

Feedback to client instead of passing the exception.

Based on the test, passing bad signatures causes kering.ValidationError to be thrown from validateSigs before kering.UnverifiedReplyError is hit.

[2byrds]

LGTM

[iFergal]

@2byrds OK, running multi-sig tests this was a mistake. UnverifiedReplyError is thrown before all signatures are gathered. Will create a new PR separating the two and bring back the pass.

[kentbull]

Agreed, yes, I am hitting the same exact problem. UnverifiedReplyError is thrown while the end role is in escrow waiting for all signatures to arrive.

[iFergal]

@kentbull fixed but still waiting for review, will add you!