Refuse an empty --require-signature or --sign-key (closes #205)

check, fetch, gen and freshen took --require-signature or --sign-key
given an empty value, on the command line or through
MFER_REQUIRE_SIGNATURE or MFER_SIGN_KEY, as the flag not given, so an
unset shell variable skipped the signature check or the signing. Each
now asks whether the flag was given, as gen's --output does. An empty
fingerprint is refused as one of the wrong length, by fetch before it
requests anything; an empty --sign-key is refused, naming the flag,
before any file is read.

Model: opus-5-5

internal/cli/freshen.go

@@ -351,7 +351,7 @@ func writeFreshenedManifest(
 }
 
 // newFreshenBuilder constructs the manifest builder configured from CLI
-// flags.
+// flags. A --sign-key given with an empty value is refused.
 func (mfa *CLIApp) newFreshenBuilder(cmd *cli.Command) (*mfer.Builder, error) {
 	builder := mfer.NewBuilder()
 	if cmd.Bool("include-timestamps") {
@@ -359,7 +359,12 @@ func (mfa *CLIApp) newFreshenBuilder(cmd *cli.Command) (*mfer.Builder, error) {
 	}
 
 	// Set up signing options if sign-key is provided
-	if signKey := cmd.String("sign-key"); signKey != "" {
+	if cmd.IsSet("sign-key") {
+		signKey := cmd.String("sign-key")
+		if signKey == "" {
+			return nil, errEmptySignKey
+		}
+
 		signing, err := mfa.signingOptions(signKey)
 		if err != nil {
 			return nil, err