[atomic] Signing Trees

[Jay Greguske <jgregusk redhat com>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hello,

How does one go about signing trees? I'd like to have some confidence
that a tree my client boots into is in fact a tree I served out from
my build server.

Do they have to be signed at the time they are created, or can it be
done after-the-fact, such as after some testing? Do the client tools
support this at all?

Thanks,
- - Jay

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.14 (GNU/Linux)

iQEcBAEBAgAGBQJUCdb9AAoJEMzORChHoQ3aSP8H/AhrG3SXdKXl4BamuUZG9Vha
4YxOCAHH2PD0jN3Lj6YlarcDdCytPCesJwDy1wbqx+344ayygAlnQMXIiohNG8+r
PF9kwKsq3PmeTNvw39AzgOgqXJBdPWQTyu3tWiI8Yuy2ief/9iVyHV8EN/d0IIhe
hhyJIx8qR8LGaIvxOcZIwp0yX/mMIcQL3/29wGQXvx1WC6u1xSN88YIr0z85QFGW
yF8X1R32zs+CPZk9w/nVu8u2c7QjpT38uAcsCcqfUhihIBhioP52wXIb920YWYS7
Ow7Myk/wS8T0pmDuU9ef7LxUVxdTh0DN60Q3mL7x9bwz0NXGVIVkAbspDWbz5yE=
=GWBO
-----END PGP SIGNATURE-----