RPMv6 proposal: treat IMA and fsverity signatures as part of the package

[DemiMarie]

In RPMv4, IMA and fsverity signatures are not considered part of the package, but of the signature. Therefore, they are included in the signature header (not the main header), which leads to various problems and increases attack surface. For RPMv6, I propose that they be considered part of the package itself, and so included in the main header. Adding IMA and fsverity signatures to a package would thus create a new package.

[pmatilai]

That's how IMA signatures originally worked but I changed it because it violates rpm's principles.
I'm quite aware of the issue(s), but this isn't the solution.