BMC Image Signing Proposal

[Adriana Kobylak]

> 
> Why are there changes to host pnor signing?
> 
> We already have secure boot and signatures on the host side, I'm not
> keen on adding in another set of signatures into yet-another already
> non-standard
> and undocumented file format.

Secure boot validates individual pnor packages, so it could be possible 
to build an image with an older individual package (like an opal n-1) 
and still be able to boot the host. Signing the whole image would catch 
this scenario.
This image signing feature in general is an extension of the current 
implementation of the software dbus interfaces, which provides options 
for a user/company to use.