`trezorctl firmware verify` changed order of checks - fingerprint is validated before signatures.