Currently, when a ZIP package (containing the CSAR package with a signature and certificate) is onboarded, SDC just stores the CSAR file as the original onboarded package, so the real original ZIP package is lost along with its certificate and signature.

Store the package that is onboarded as the original onboarded package, whether it's a CSAR or a ZIP.