catch missing public key

catch missing public key

fix and document requirements for signature uploads

save public key when doing signature uploads

gocsaf/csaf#685