docs: correct the prior commit note — the verify extra uses cryptography, not pynacl

The previous commit message said the [verify] extra pulls PyNaCl; the code and pyproject.toml use cryptography>=41, chosen because this ecosystem's dedicated python verifier already depends on cryptography and using pynacl would put one receipt format behind two crypto stacks. The code was always correct; only that commit note was wrong.

Author: zsobpeter-code