Specify what exactly happens to events that fail signature verification

It seems like there's a bit of a divide on how servers handle this, so we should either be more clear or put it in the spec.

Start by locating the specification sections that describe event signature verification and review how the behavior is currently stated. Compare the differing server-handling expectations described by the issue, then clarify the specification so the outcome for failed verification is explicit.

Written by the indexing model from the issue text.