Misleading warning from --verify

[openstrike]

I've spent a little time chasing at shadows today because the error message from --verify says

WARNING: Module::Signature and Digest::SHA is required for distribution verifications.

even when both of those modules are installed and usable but when cpansign is not (or as in my case is not in the current $PATH). I think these 2 necessary requirements for --verify should be tested for separately and the appropriate message delivered to the user instead.

If you agree, I'm happy to raise a PR - just tell me which branch to base it on, please.

[pryrt]

I get that warning even when I have both modules and cpansign is already installed and in my PATH.