mcr example of signing SPDX content with COSE