fix(core/headertool): always rehash when inserting signature (fixes #2616)

[no changelog]

core/tools/headertool.py

@@ -163,9 +163,6 @@ def cli(
     if replace_vendor_header:
         do_replace_vendorheader(fw, replace_vendor_header)
 
-    if rehash:
-        do_rehash(fw)
-
     if sign_dev_keys:
         if not isinstance(fw, firmware_headers.CosiSignedImage):
             raise click.ClickException("Can't use development keys on this image type.")
@@ -193,6 +190,9 @@ def cli(
             raise click.ClickException("Can't sign this image type.")
         fw.insert_signature(signature, sigmask)
 
+    if signature or rehash:
+        do_rehash(fw)
+
     click.echo(f"Detected image type: {fw.NAME}")
     click.echo(fw.format(verbose))