Sign or annotate a fixed image specified in the form definition

@danbjoseph Perhaps something to bring up with the TSC? Once there's agreement on the specification side, this should be really quick to ship. That discussion has started here. I strongly favor the "defaults" approach but am open to alternatives if there's strong consensus. In particular, I'd really like to see an example form for what @martijnr was describing on that thread.