To allow for content-addressable manifests, we'll need to store signatures separately from the targeted content. If multiple signatures are available for a given manifest, they should be merged.

This issue is part of moving towards immutable manifest ids and there are other changes that need to take place to receive the benefit. Discussion is in docker-archive/docker-registry#804.