updates: Add script for enabling the official update signing key.

This script should be called before running build_image when generating
official production images. Images built with official key will not
accept updates signed with the default development signing key.