Refuse an empty --require-signature or --sign-key (closes #205)

check, fetch, gen and freshen took --require-signature or --sign-key
given an empty value, on the command line or through
MFER_REQUIRE_SIGNATURE or MFER_SIGN_KEY, as the flag not given, so an
unset shell variable skipped the signature check or the signing. Each
now asks whether the flag was given, as gen's --output does. An empty
fingerprint is refused as one of the wrong length, by fetch before it
requests anything; an empty --sign-key is refused, naming the flag,
before any file is read.

Model: opus-5-5

internal/cli/fetch.go

@@ -429,6 +429,14 @@ func (mfa *CLIApp) fetchManifestOperation(
 func (mfa *CLIApp) fetchManifest(
 	ctx context.Context, cmd *cli.Command, client retryingClient, manifestURL string,
 ) ([]byte, []*mfer.MFFilePath, error) {
+	// An empty fingerprint is refused before anything is requested, with
+	// the message check gives for it; any other is checked against the
+	// manifest once it is downloaded.
+	requiredSigner := cmd.String(flagRequireSignature)
+	if cmd.IsSet(flagRequireSignature) && requiredSigner == "" {
+		return nil, nil, fmt.Errorf("%w, got 0", errInvalidFingerprint)
+	}
+
 	log.Infof("fetching manifest from %s", manifestURL)
 
 	// Read the whole manifest before parsing it, so that a connection
@@ -460,7 +468,6 @@ func (mfa *CLIApp) fetchManifest(
 		return nil, nil, fmt.Errorf("parse manifest: %w", err)
 	}
 
-	requiredSigner := cmd.String(flagRequireSignature)
 	if requiredSigner != "" {
 		err = verifyFetchedSigner(manifestData, requiredSigner)
 		if err != nil {