[T-Mobile Samsung Galaxy S7 Edge Guides, News, & Di] chenxiaolong:
I'm not sure how the boot.img is signed, but all of the other partitions (eg. trustzone) have three DER-encoded 2048-bit RSA certificates in them:

chenxiaolong@cxl-4270cto: /stuff/Android/DualBoot/TWStock/Odin/G935TUVU1APB6
$ tar xvf ../ALL_TMB_G935TUVU1APB6_G935TTMB1APB6_CL7103056_QB8543665_REV02_user_low_ship_MULTI_CERT.tar.md5 tz.mbn
tz.mbn

chenxiaolong@cxl-4270cto: /stuff/Android/DualBoot/TWStock/Odin/G935TUVU1APB6
$ binwalk -e tz.mbn [0:01:22]

DECIMAL HEXADECIMAL DESCRIPTION
--------------------------------------------------------------------------------
0 0x0 ELF, 64-bit LSB executable, version 1 (SYSV)
4872 0x1308 Certificate in DER format (x509 v3), header length: 4, sequence length: 1253
6129 0x17F1 Certificate in DER format (x509 v3), header length: 4, sequence length: 1080
7213 0x1C2D Certificate in DER format (x509 v3), header length: 4, sequence length: 1038
826352 0xC9BF0 XML document, version: "1.0"
852692 0xD02D4 SHA256 hash constants, little endian
880886 0xD70F6 Unix path: /dev/buses/qup/blsp1_qup0

chenxiaolong@cxl-4270cto: /stuff/Android/DualBoot/TWStock/Odin/G935TUVU1APB6
$ openssl x509 -in _tz.mbn.extracted/1308.crt -inform DER -text -noout [0:01:37]
Certificate:
Data:
Version: 3 (0x2)
Serial Number: 1 (0x1)
Signature Algorithm: sha256WithRSAEncryption
Issuer: C=KR, ST=South Korea, L=Suwon City, O=Samsung Corporation, OU=DMC, CN=Samsung AttestationCA cert/emailAddress=m.security@samsung.com
Validity
Not Before: Feb 9 09:58:54 2016 GMT
Not After : Feb 4 09:58:54 2036 GMT
Subject: C=US, CN=SecTools Test User, L=San Diego, O=SecTools, ST=California, OU=01 0000000100000007 SW_ID, OU=02 009470E100200000 HW_ID, OU=04 0020 OEM_ID, OU=05 00000208 SW_SIZE, OU=06 0000 MODEL_ID, OU=07 0001 SHA256, OU=03 0000000000000002 DEBUG
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
Public-Key: (2048 bit)
Modulus:
00:dd:be:71:82:6d:3d:aa:7f:39:5e:de:f5:75:d4:
bc:ce:06:8b:6d:6c:a3:2d:0e:4b:fc:5b:1e:aa:d5:
49:2a:41:81:8f:3b:b4:4a:f7:46:dd:f6:4a:9a:c1:
79:cd:f4:e0:1a:4c:69:b4:8d:ae:56:ff:c2:f7:29:
69:d5:8e:a8:e7:95:d9:57:1a:d3:d6:e5:2c:ff:a9:
f2:e9:98:34:ad:e1:9f:88:c8:89:a5:86:34:a5:49:
a7:56:96:78:12:6b:94:55:bf:c6:85:98:49:1c:ab:
02:87:64:01:09:f8:28:4c:6f:29:45:13:1c:26:56:
a7:f0:40:3b:fa:35:2a:96:3a:88:9d:68:b5:dc:96:
bd:51:5e:91:41:a7:ae:63:09:d8:f8:89:d3:42:d8:
f5:52:a2:12:64:0f:68:c0:1b:9c:0a:3f:be:fe:4b:
0e:9a:f9:ba:7b:59:41:18:59:30:13:86:8e:45:46:
ca:96:6f:8e:85:33:f4:e5:e8:22:f9:4e:81:3e:81:
3a:b4:a2:22:22:8d:8a:17:1b:bd:ea:6b:6d:e7:41:
51:a7:0e:1d:58:4c:25:cd:d3:a9:01:b7:49:da:b8:
61:0f:89:30:08:80:21:1d:d6:04:74:d7:2f:01:ec:
49:b3:fa:d3:99:0d:89:a6:39:78:0d:e9:34:db:ee:
d3:a1
Exponent: 65537 (0x10001)
X509v3 extensions:
X509v3 CRL Distribution Points:

Full Name:
URI:http://crl.qdst.com/crls/qctdevattest.crl

X509v3 Authority Key Identifier:
keyid:19:FD:7B:43:0B:CD:D6:6D:01:02:48:84:3F:6F:56:23:19:A6:C4:A3

X509v3 Basic Constraints:
CA:FALSE, pathlen:0
X509v3 Key Usage:
Digital Signature, Non Repudiation, Key Encipherment, Data Encipherment
Signature Algorithm: sha256WithRSAEncryption
7c:c6:dd:2a:f5:fa:82:70:a1:8b:20:e2:a1:62:58:dc:73:7f:
01:52:94:97:06:00:94:88:3e:66:1d:e9:bd:d8:71:19:1c:bc:
65:bb:42:2e:42:36:a5:7f:17:01:f6:0e:5e:90:ac:7f:00:55:
2f:c7:20:de:b8:39:9c:fb:46:99:4d:ed:c1:e7:4c:ce:01:e1:
c1:2d:ea:8f:7e:2f:3f:a6:9e:d5:4d:a3:d9:82:14:77:ce:44:
f5:5c:22:bc:18:03:01:7a:b9:92:16:2b:2f:4c:9c:d8:ba:30:
ec:09:6f:5b:8e:bb:7d:14:70:8b:3f:7c:2e:ba:42:a7:55:87:
97:87:95:57:51:36:53:9f:33:de:0f:50:06:93:97:43:7e:81:
77:f5:12:d4:9d:b7:99:26:16:d1:fd:5a:81:be:74:f2:16:14:
b3:67:e6:a7:d0:50:a4:fe:c1:c6:48:3b:11:c0:52:5b:54:85:
4f:f0:f4:9c:44:8e:ec:62:2f:af:ed:7f:72:6f:b3:dd:2c:a4:
fb:1d:6d:ac:e0:5d:34:7e:5c:34:28:ea:98:8b:7a:c2:f9:a0:
a2:4f:1a:7f:6c:bf:1c:94:05:18:71:cb:39:35:ad:8f:ce:e7:
2b:79:31:2b:7f:0a:d0:7f:3e:44:84:37:80:a3:dc:87:98:1e:
6d:ea:0a:41

chenxiaolong@cxl-4270cto: /stuff/Android/DualBoot/TWStock/Odin/G935TUVU1APB6
$ [0:02:15]