Support multiple endorsers/signatures per skill

[melvincarvalho]

Summary

Currently, skills support a single .aam.sig file, meaning only one signature can exist per skill. A web-of-trust model would benefit from multiple endorsements.

Proposal

Allow multiple entities to sign/endorse a skill:

• Original author signature proves authorship
• Additional endorsers add trust (security reviewers, trusted community members, etc.)
• More signatures = higher confidence in the skill

Possible Implementation

1. Store multiple signatures (e.g., .aam.sig becomes an array, or use .aam.sigs/ directory)
2. Each signature is a separate Nostr kind 31337 event with the same skill hash but different pubkeys
3. aam skills verify could show all endorsers
4. aam skills sign could append rather than overwrite

Use Cases

• Package maintainers endorse skills they've reviewed
• Organizations endorse skills for internal use
• Community builds reputation through endorsement chains

This aligns with how trust works in GPG key signing, Linux package repos, and the broader Nostr ecosystem.