Support signing attestations by multiple signers

[ChaosInTheCRD]

Currently if an attestation is generated with witness run, it cannot be resigned later on by another identity.

The ability for a user to call witness run in reference to an attestation that has already been generated and signed by another identity could be useful as confirmation of some process having been executed against the metadata that the attestation contains.