KeySets: better rejection for badly-formed manifest

During testing, I typed in a <publicKey> tag incorrectly and it
clobbered the previously defined key entry since it still parsed the
subsequent <keyset> tag defining an alias.

This gives more information in the log when running into such parsing
errors.

Change-Id: Id3c8e85530b1a5e39f4a2cb6ea8bd5521cb6918f