Main Changes: create_manifest() includes public key in the manifest, retrieve_rawmanifest() verify signature, main() in vendor signs the manifest, client and mirrors keep asking manifest if not verified.