refactor: don't fail if extra signatures we don't care about

[grzuy]

Not seen cases of this but per their spec is possible multiple signatures coming in this field. https://docs.npmjs.com/about-registry-signatures#supporting-signatures-on-third-party-registries Just playing safe so that it doesn't break if something changes in the package metadata response.

[josevalim]

:green_heart: :blue_heart: :purple_heart: :yellow_heart: :heart: