fit signing without access to private key

Hi. We want to sign fitImages but our company policies does not allow access to the private signing key from our build machines. Is there a way using e.g. mkimage to

1. Generate the hash of a fitImage configuration section? We will then request a signature for the hash from our enterprise PKI. 2. Incorporate the signature in the fitImage?

BR / Mikael