https://yairgadelov.me/swupdate-build-sign-install-a-minimal-.swu-that-updates-only-an-app--config/
sw-description
sw-description.sig
SWUpdate can use PKCS provider.