Update the retire interval after full sign

Update the retire interval after full sign

After a full sign we no longer have to need to take the sign delay into
account. Update the timing checks in keymgr_transition_time to determine
the start of the interval: Either the last change, or if SigPublish/
SigDelete is set. The latter case indicates a full sign was done and
so we no longer have to take the sign delay into account.

(cherry picked from commit 489752eb1f7f4e09bcf96d723ae64158cf785f97)