signing keys

[mobileoverlord]

Adds initial support for signing runtime binaries using managed key files or hardware backed keys via pkcs:11 supporting TPM2 and yubikey. This includes new commands for managing global signing keys on the system:

• avocado signing-keys create: Create new signing keys
• avocado signing-keys list: list all signing keys
• avocado signing-keys remove remove signing keys, pass --delete to remove the key file or token from the HW store.

Signing keys are associated with runtimes via new config options

signing_keys:
  - dev-key: sha256-069beb292983492c
  - yubikey: sha256-51d3f5bbbbde5b8d
  - tpm2: sha256-f26976a17c9bdce1

runtime:
   dev:
     signing:
       key: tpm2

Runtime images are signed with a separate step

avocado sign -r <runtime-name>
#or
avocado runtime sign -r <runtime-name>