pre-hash sign the kernel image; normal signing for loader image

The loader image uses the original signing method, because changing
that would require us to modify the gateware ROM, which is a huge
pain in the ass, and doesn't buy us anything.

Thus only the kernel signing uses the pre-hash method.

tools/src/bin/sign-image.rs

@@ -108,6 +108,7 @@ fn main() -> Result<(), Box<dyn std::error::Error>> {
             &loader_pkey,
             matches.is_present("defile"),
             &minver,
+            false
         )?;
     }
 
@@ -131,6 +132,7 @@ fn main() -> Result<(), Box<dyn std::error::Error>> {
             &kernel_pkey,
             matches.is_present("defile"),
             &minver,
+            true,
         )?;
     }
     Ok(())