Function build_signer_from_args 

pub fn build_signer_from_args(
    cert_path: &Path,
    tpm_pubkey_raw: Option<&Path>,
    tpm_sign_wrapper: Option<&Path>,
    fleet_ca_key: Option<&Path>,
) -> Option<Arc<dyn CaSigner>>

Builds a CaSigner from a flag triple. TPM (pub_raw + wrapper) wins over file (fleet_ca_key); both absent -> None (enroll/renew will 500).