fit signing without access to private key

[Mikael Pahmp]

Hi. We want to sign fitImages but our company policies does not allow
access to the private signing key from our build machines. Is there a way
using e.g. mkimage to

   1. Generate the hash of a fitImage configuration section?
   We will then request a signature for the hash from our enterprise PKI.
   2. Incorporate the signature in the fitImage?

BR / Mikael