Get Signing Keys

Return the signed key bundle used by booting VMs to fetch and verify cosign/Helm keys.

Each entry in 'keys' is a base64-encoded public key; the corresponding entry in 'signatures' is a base64-encoded detached PGP signature produced by the root signing key. Intentionally public — no mTLS required. Independent third parties and auditors can fetch these public keys to verify TDX quotes without needing to be a VM client.