Added signed statements section & example

Discussion points / differences from original proposal

* referenced a signature 'attachmentUsage' uri, if ADL does not want to own this we need to find another home: "http://adlnet.gov/expapi/attachments/signature"
* restricted algorithm to RSA + SHA2 (with key/hash length options) for interoperability
* requirement that X.509 certificates SHOULD be used, as this allows embedding information about the signer and including the public key
* added LRS requirements for validation -- to reject mistakes, not as a security measure