Manifest Signature Generation And Receipt Validation

Unique: Implements manifest signing as optional metadata (signatures in receipts array) rather than a required field, enabling providers to adopt signing incrementally without breaking existing manifests. Supports multiple signatures for key rotation scenarios where old and new keys are both valid.

vs others: Provides simpler manifest signing than full PKI (no certificate authority required) while enabling cryptographic verification, at the cost of requiring providers to manage key rotation manually.