PSA: apparently nostr-tools' verifySignature no longer throws an error, it returns a boolean instead. I'm not sure how long that has been the case.