feat: verify kmod signatures for dual-sign

[m2Giles]

Thank you for contributing to the Universal Blue project!

Please read the Contributor's Guide before submitting a pull request.

[m2Giles]

This checks during build stage and not in the final rpms. This doesn't ensure that the final copied rpms have the signatures. We could do that with another container much like getting the ostree.linux parameter but probably would need a Containerfile to build it.

[m2Giles]

To build another container to test the rpms would likely have a longer build time than the actual akmods build.

So not sure what the best method for ensuring the RPMs that are copied into the scratch container are indeed dual signed.

[m2Giles]

Went and made a test container that is built after the akmods is built. It installs the kernel and the signed rpms, and then checks the signatures. It can handle both dual signed and single signed. It will stop a push if the the akmods are not signed correctly.

[bsherman]

Beautiful