Signed recovery configuration. Clients must verify the signature using their pre-installed trust key.