If EdDSA verification passes we don't need to have DSA verification pass, and don't need to require the new update to contain a DSA signature or keys.
Also reject updates if app has EdDSA but no EdDSA signature is provided
This gets more complicated, since binaries can be just code-signed, or
use both code signing and DSA keys, or be rotating keys for one or the
other.
The code signing test cases emulate certificate rotation by changing
the "identifier" for the bundle; the script used to sign each bundle
(with ad hoc signing) is included to support future expansion of
testing.
The actual tests here are the same as pre-validation; things only get
complicated when validating with code signing. The setup's a little
more involved though, since we need a supposedly-downloaded bundle to
do anything.
Also test invalid signatures, which are not always the same as absent
signatures.
Zorg
Jordan Rose