Add "nix sign-paths" command

E.g.

  $ nix sign-paths -k ./secret -r $(type -p geeqie)

signs geeqie and all its dependencies using the key in ./secret.

src/libstore/store-api.cc

@@ -312,6 +312,9 @@ void Store::exportPaths(const Paths & paths,
 
 std::string ValidPathInfo::fingerprint() const
 {
+    if (narSize == 0 || narHash.type == htUnknown)
+        throw Error(format("cannot calculate fingerprint of path ‘%s’ because its size/hash is not known")
+            % path);
     return
         "1;" + path + ";"
         + printHashType(narHash.type) + ":" + printHash32(narHash) + ";"