Sign final packages with a different key if requested

...and throw it into recovery builds as well

Change-Id: Ic96d4d49d821cb03d5318e3e9ad93d02fb92573e