For OTA-915 to work, we need to add code in Cincinnati so that it can recognize when the graph tar ball contains image signatures.

Also we need to agree on the schema for the signatures directory structure.

From OTA-912, this is the suggested schema

$ tree signatures signatures └── sha256 ├── 5e8f403a14eed840b01434115300f2e68cd1232aa47f9509433a46341da2f2b8 │   └── signature-1 ├── 750fe7239f8633662899a68a1204f57b7ea92189ea8024ed18d9948d1fed00b6 │   └── signature-1 └── bdc145f7f6347433f8461a1133d6354abf52268925ce7459a4294d44b9beb4ef └── signature-1 4 directories, 3 files

Definition of done:

• Update cincinnati-graph-data repository with signatures in the schema.
• Add a section to the readme cincinnati-graph-data repository explaining the change.
• Bump the version of cincinnati-graph-data schema