kage signature either from embedded package signature
 or if it is absent then reads data from detached signature file.
 @param pkg a pointer to package.
 @param sig output parameter for signature data. Callee function allocates
 a buffer needed for the signature data. Caller is responsible for
 freeing this buffer.
 @param sig_len output parameter for the signature data length.
 @return 0 on success, negative number on error.