Sign takes the path of a container and generates an OpenPGP signature block for
its system partition. Sign uses the private keys found in the default
location if available or helps the user by prompting with key generation
configuration options. In its current form, Sign also pushes, when desired,
public material to a key server.
Verify takes a container path and look for a verification block for a
specified descriptor. If found, the signature block is used to verify the
partition hash against the signer's version. Verify takes care of looking
for OpenPGP keys in the default local store or looks it up from a key server
if access is enabled.