Add support for using separate developer firmware keyblock while signing.

scripts/image_signing/sign_official_build.sh

 #!/bin/bash
 
 # Copyright (c) 2010 The Chromium OS Authors. All rights reserved.
 # Use of this source code is governed by a BSD-style license that can be
 # found in the LICENSE file.
 
 # Sign the final build image using the "official" keys.
 #
 # Prerequisite tools needed in the system path:
 #
@@ skipping 243 matching lines @@
   else
     gbb_utility -s \
       --rootkey=${KEY_DIR}/root_key.vbpubk \
       --recoverykey=${KEY_DIR}/recovery_key.vbpubk \
       ${shellball_dir}/bios.bin ${temp_outfd}
   fi
   # Resign the firmware with new keys
   ${SCRIPT_DIR}/resign_firmwarefd.sh ${temp_outfd} ${shellball_dir}/bios.bin \
     ${KEY_DIR}/firmware_data_key.vbprivk \
     ${KEY_DIR}/firmware.keyblock \
+    ${KEY_DIR}/dev_firmware_data_key.vbprivk \
+    ${KEY_DIR}/dev_firmware.keyblock \
     ${KEY_DIR}/kernel_subkey.vbpubk \
     ${FIRMWARE_VERSION}
 
   # Replace MD5 checksum in the firmware update payload
   newfd_checksum=$(md5sum ${shellball_dir}/bios.bin | cut -f 1 -d ' ')
   temp_version=$(make_temp_file)
   cat ${shellball_dir}/VERSION |
   sed -e "s#\(.*\)\ \(.*bios.bin.*\)#${newfd_checksum}\ \2#" > ${temp_version}
   sudo cp ${temp_version} ${shellball_dir}/VERSION
 
@@ skipping 207 matching lines @@
   resign_firmware_payload ${INPUT_IMAGE}
   update_rootfs_hash ${INPUT_IMAGE} \
     ${KEY_DIR}/installer_kernel.keyblock \
     ${KEY_DIR}/installer_kernel_data_key.vbprivk \
     2
   sign_for_factory_install
 else
   echo "Invalid type ${TYPE}"
   exit 1
 fi