build: fail if any step of signing v2 firmwares fails

What changed, and why it matters

This commit hardens the firmware signing script used when releasing Blockstream Jade hardware wallet firmware. It adds `set -e` so the script stops immediately if any command fails, and explicitly checks that the public and private key files exist before proceeding. Without these changes, the script could silently continue past errors (for example, if a key file was missing or a signing command failed), potentially producing or releasing firmware that was not properly signed. Proper signing is important because users rely on firmware signatures to verify that the software running on their device is authentic and has not been tampered with.

Security signals we found

Evidence from the diff

Changed components

diff --git a/release/scripts/v2sign.sh b/release/scripts/v2sign.sh
index 83bc9c0..59bc3b0 100755
--- a/release/scripts/v2sign.sh
+++ b/release/scripts/v2sign.sh
@@ -1,5 +1,7 @@
 #!/bin/bash
 
+set -e
+
 if [ -z "${1}" -o -z "${2}" ]
 then
     echo "Usage: ${0} <version/dir> <key_label>"
@@ -26,6 +28,9 @@ VERIFY_OPTS="-pubin -inkey ${PUBKEY} -pkeyopt digest:sha256 -pkeyopt rsa_padding
 
 pushd "${WORKING_DIR}"
 
+[ -f ${PUBKEY} ] || false # Public key file must exist
+[ -f ${KEY} ] || false # Private key file must exist
+
 # Verify bootloaders are same
 sha1=$(sha256sum "${BLEDIR}/bootloader/bootloader.bin" | cut -d\  -f1)
 sha2=$(sha256sum "${NORADIODIR}/bootloader/bootloader.bin" | cut -d\  -f1)