Implement collection artifact signing

[alikins]

Feature Request

Implement collection artifact signing.
(This is #201 split into two parts, one for chksum validation and this one for signature support.)

Use Case

What problem does this feature solve? Please describe.

Currently, there is no way to verify who created an ansible collection artifact. There is a detached sha256sum of the artifact calculated and included on 'mazer publish', but that does not provide any crypto signatures (ie, a detached GPG signature).

Common practice for package and payload management tools is to provide a way for the artifact create to cryptographically sign the artifacts. Typically, this is optional, but verification can be enforced at package install time (or for a tool like galaxy, when the artifact is uploaded to publish).

Currently, mazer supports neither signing any artifact signature.

Proposed Solution

More than likely, something GPG based. Thats the most commonly used approached.

Drawbacks: crypto is hard

Alternatives

Implementation

Likely emulate the workflow used by tools like dpkg,rpm,pip/pypi, etc.