The avb_pkmd.bin file isn't needed for generating a signed release but
rather to set the public key used by the device to enforce verified boot.
Generate a signify key for signing factory images:
+ +signify -G -n -p keys/factory.pub -s keys/factory.sec+ +
Remove the -n switch to set a passphrase. The signify
+ tool doesn't provide a way to change the passphrase without generating a new key, so
+ this is currently handled separately from encrypting the other keys and there will be
+ a separate prompt for the passphrase. In the future, expect this to be handled by the
+ same scripts along with the expectation of it using the same passphrase as the other
+ keys.