cm versioning: Empty keys == default keys

Don't assume the path to the signing key is the default, it can
be empty and have the same meaning...

Change-Id: Id545d6436e9f21d6b62eec5a317ea7665190f104