updates are signed by the maintainer's key — agents: POST /api/projects/testupload-xyz/updates with X-ND-Owner / X-ND-Signature.
POST /api/projects/testupload-xyz/updates