FR: multiple signatures from multiple sources

[znewman01]

I would like to at least explore the idea of multiple signatures as well. Different objects in a repository like java might come from different sources and then uploaded together, so adding a bundle to a repository might involving merging multiple signature objects?

Which is slightly different than say one person collecting all the artifacts and singing them after the fact.

Originally posted by @loosebazooka in #48 (comment)