Signing enclave images with HSM/KSM

Currently the only option to sign an enclave image is to pass the private key and the certificate to build-enclave command. However, it prevents storing the key in a secure storage like HSM or KSM, and using it only for signing without retrieving the key itself.
One solution is to allow to add the signature after the enclave was created, so the signature can be produced independently from the enclave creation.

Start with the build-enclave command and trace how enclave images currently receive their signatures. Define the signing boundary and confirm that a completed image can be signed independently through HSM/KSM without retrieving the private key; the issue names no files or tests to run.

Written by the indexing model from the issue text.