coreos_sign_update: return 'legacy' signing support
coreos_sign_update: return 'legacy' signing support

We currently sign with both a devel key and a prod key. The devel key is
insecure and need not be included on a smartcard, so it makes sense to
leave it be on disk.

However, the previous commit's padding changes removed this legacy
method of signing.
For simplicity, simply re-introduce the old logic conditionally based on
whether it's a smartcard or not.

Alternate options could be using `-pkcs` instead of `-raw` for both
keys, but that is a more intricate change I'd be less confident in
making.

glevand/coreos--scripts,coreos/scripts,glevand/coreos--scripts,coreos/scripts