Fixed warnings at package-signing time

When signing a file the certificate and key need to be checked, but not
the signatures or digests (as they have not been generated).  Now, when
both signatures and digests are empty no warning is given as this
indicates the caller only wants to verify the chain and key.