Now sign cloned manifests so their sigs are valid

* clone take a new arg, the url of a key to sign with
* keys are only downloaded once per url
* Seems to be an issue trying to clone manifests before initializing selenium in the repl, if this becomes an issue we can probably initialize the crypto lib ourselves, rather than having sel do it.