check if kasp and signconf are in sync

Now that the auditor handles policy changes, it would be good to check if the kasp and signconf are in sync, prior to regular audit. In this case, we can more easily determine what's the cause of an audit fail: signer engine error or propagation delay of the new policy