Two multipart/form-data parts:
• metadata – JSON (VerifyDetachedJwsStreamRequest)
with a detached-JWS (General-JSON).
• file – the binary payload originally signed.
Extracts kid and alg from the header, verifies
and returns a VerifySignatureResponse.


Supports both SIMPLE keys (compact JWS with single signature) and COMPOSITE keys
(General JSON with multiple signatures and anka_composite_kid field).