Feature request: Buildkite job that verifies all of the signatures, but doesn't unlock any secrets, launch any pipelines, or sign the initial buildkite job ID

Take this PR as an example: https://github.com/JuliaLang/julia/pull/42511

This PR modifies the .buildkite/pipelines/scheduled/coverage/coverage_linux64.yml file. This is going to cause the signature check to fail. However, since the coverage job only runs on the scheduled pipeline, the CI will pass on that PR.

I'd like to have a CI job that simply verifies the signatures of every signed pipeline under a given path. For example, in this case, I want to verify the signature of every signed pipeline under .buildkite/, regardless of whether or not those pipelines are going to be run. And I want to do so without unlocking any secrets, launching any pipelines, or signing the initial buildkite job ID.

That way, this CI job will fail on PRs such as https://github.com/JuliaLang/julia/pull/42511, which will alert the maintainer (me) that I need to fix the signature beforing merging the PR.

Also, I would like to do this signature verification using only the public key (https://github.com/staticfloat/cryptic-buildkite-plugin/issues/11). Since we aren't unlocking secrets, launching pipelines, or signing the initial buildkite job ID, there is no need for this CI job to use the private key.

Start by reviewing the referenced .buildkite/pipelines/scheduled/coverage/coverage_linux64.yml file and the linked cryptic-buildkite-plugin issue #11. Identify how signed pipelines under .buildkite/ are currently handled, then define verification behavior that uses only the public key and performs no secret unlocking, pipeline launching, or initial job-ID signing. Done means the CI job fails when any signed pipeline signature is invalid.