feat: Decouple signing

[rdimitrov]

Moved from rdimitrov/go-tuf-metadata#62, raised by @udf2457

Is your feature request related to a problem? Please describe.

From my brief reading of the metadata code, at present your library appears to make the same mistake as theupdateframework/go-tuf in that key signing is tighly coupled to primitive and crude on-disk keyfiles.

This means that real-world secure key storage such as PKCS#11 (#427), AWS KMS (#525) and others e.g. Yubikey are not readily supported and require hacky work-around kludges to work (e.g. manually hacking json files).

Describe the solution you'd like

Of course support for signing from local keyfiles stored on disk should remain, but integration with real world applications where the private key is stored in a non-exfilterable format should be supported.

Describe alternatives you've considered

No response

Additional context

No response