Add --subkey_in and --subkey_out options to firmware signing utility.

src/platform/vboot_reference/vkernel/include/kernel_image.h

Index: src/platform/vboot_reference/vkernel/include/kernel_image.h
diff --git a/src/platform/vboot_reference/vkernel/include/kernel_image.h b/src/platform/vboot_reference/vkernel/include/kernel_image.h
index 73ed3a56cd7bbc16c7826e5419473396e5ac355c..09343ea14e4ea5618d1e1d8d868fad0409c8906b 100644
--- a/src/platform/vboot_reference/vkernel/include/kernel_image.h
+++ b/src/platform/vboot_reference/vkernel/include/kernel_image.h
@@ -56,7 +56,11 @@ uint8_t* GetKernelBlob(const KernelImage* image, uint64_t* blob_len);
 
 
 /* Write kernel data from [image] to a file named [input_file].
- * If [is_only_vblock] is non-zero, only the verification block is output.
+ *
+ * If [is_only_vblock] is non-zero, only the verification block (excluding the
+ * actual kernel data) is output.
+ * If [is_subkey_out] is non-zero, only the kernel key verification (subkey)
+ * header is output.
  *
  * Return 1 on success, 0 on error.
  */