This is needed when bootstrapping the system.

This solves issues for rsync jobs for mirrors.

So basicly, running 'abuild-keygen -a -i' will be all you need to do to
be able to use abuild-sign and install the signed packages.

we can only sign indexes so far

- ability to embed an checksum inside the tar header for regular
  files (to avoid checksumming at apk installation time)
- way to remove the end-of-archive marker to create concenatable
  .tar.gz:s for signed apks