trunion api (bugs 1070189, 1070191)

WIP, DO NOT MERGE

Bug 1070189: Call the trunion API (not tested with servers yet)
Bug 1070191: Signing management command
How about creating the tempfile when needed (line 91), and doing the `try...finally` just there? This would also render this function useless, and only leave `_sign_addon` (which you could obviously rename to `sign_addon`).

Does that make sense?