Rpm v6 signatures sorted last in the output order

As pointed out in #4043 review, rpm v6 signatures get sorted last ... because we don't populate the sigalgo value for the verify items, because of an oversight when introducing v6 signatures, because the sorting was buggy (#1057) but couldn't be easily fixed due to verify logic errors (#3996) and prevented the oversight from manisfesting itself.