Allow the usage of builtin keys in verification

[davidvincze]

Introduce a new MCUBOOT_BUILTIN_KEY option to enable the usage of
builtin keys for signature verification. This way the details of the key
handling mechanism are abstracted away from the boot code and this
responsibility is delegated to the given crypto library.
This is an alternative option to the existing MCUBOOT_HW_KEY feature,
however in this case we can entirely rely on key IDs and not only the
code, but also the image metadata does not contain any public key data.

Enable the usage of builtin keys in the ECDSA verification module with
the PSA Crypto API based cryptographic backend.
This way parsing and importing the verification keys can also be avoided.

[tamasban]

LGTM as an initial support for builtin keys. However, in the long run, might be better to provide a user-facing solution to specify the key ID. In the current solution, it is the responsibility of the crypto library. It seems hidden to me, and might not fit to a general crypto library.

Options could be:

• provide a HAL API
• add a TLV which holds the key-id

Could you open an issue to track this?

[davidvincze]

LGTM as an initial support for builtin keys. However, in the long run, might be better to provide a user-facing solution to specify the key ID. In the current solution, it is the responsibility of the crypto library. It seems hidden to me, and might not fit to a general crypto library.

Options could be:

• provide a HAL API
• add a TLV which holds the key-id

Could you open an issue to track this?

I've just opened an issue to track: #1935
The current code was meant as an initial "solution", a better mechanism is up for discussion.