Use rsa for http signing

[anbraten]

Using rsa for http would allow us to keep the secret secret 😉
This will be especially helpful when allowing more extensions in addition to the current configuration service to be settable per repo.
The current lib used for signing doesn't support that but we could try https://github.com/go-fed/httpsig

[mscherer]

The current lib seems not maintained (last commit in 2017), but the new one seems also not moving a lot (last commit 1 year ago). But that's indeed better.