internal/signature.FromBlob is not forward-compatible

[mtrmac]

i.e. it can’t process images with currently-unknown format IDs at all.

We should add some kind of internal/signature.Unknown implementation that preserves the blob without interpreting it, to allow copying and pulling such images.