Fix CDDL for signatures.

The signature is not CBOR-encoded, it's the raw bytes of the signature
encoded as specified for the specific algorithm.

I've made the references to PureEd25519() / ECDSA() into comments,
since I believe they're not actually legal CDDL but are aimed at
humans. And I've made the two occurrences consistent with each other.

Test: N/A
Change-Id: Ia42362ff3d0ce5458322663256cbd34d258afe76