Enable Google KMS and Azure Key Vault for publisher login tool (#696)

<!-- Provide a brief summary of your changes -->

## Motivation and Context

This allows the private key used for DNS or HTTP based authentication to
be stored securely in a cloud key management system. These services
often provide HSM storage which makes it very hard to leak the private
key.

The full context is described in my design document here:

https://github.com/modelcontextprotocol/registry/issues/482#issuecomment-3437117171

## How Has This Been Tested?

I have tested it against PROD using an Ed25519 key stored in Google KMS.
I have added unit tests. I have tested both ECDSA P-384 and Ed25519 with
Az KV and Google KMS against a locally running server.

## Breaking Changes

None intended.

## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [ ] Bug fix (non-breaking change which fixes an issue)
- [x] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [x] Documentation update

## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [x] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [x] My code follows the repository's style guidelines
- [x] New and existing tests pass locally
- [x] I have added appropriate error handling
- [x] I have added or updated documentation as needed

## Additional context
<!-- Add any other context, implementation notes, or design decisions
-->

---------

Co-authored-by: adam jones <domdomegg+git@gmail.com>

docs/reference/cli/commands.md

@@ -81,6 +81,7 @@ mcp-publisher login dns --domain=example.com --private-key=HEX_KEY [--registry=U
 - Verifies domain ownership via DNS TXT record
 - Grants access to `com.example.*` namespaces
 - Requires Ed25519 private key (64-character hex) or ECDSA P-384 private key (96-character hex)
+  - The private key can be stored in a cloud signing provider like Google KMS or Azure Key Vault.
 
 **Setup:** (for Ed25519, recommended)
 ```bash
@@ -112,6 +113,62 @@ openssl ec -in key.pem -text -noout -conv_form compressed | grep -A4 "pub:" | ta
 openssl ec -in <pem path> -noout -text | grep -A4 "priv:" | tail -n +2 | tr -d ' :\n'
 ```
 
+**Setup:** (for Google KMS signing)
+
+This requires the [gcloud CLI](https://cloud.google.com/sdk/docs/install).
+
+```bash
+# log in and set default project
+gcloud auth login
+gcloud config set project myproject
+
+# Create a keyring in your project
+gcloud kms keyrings create mykeyring --location global
+
+# Create an Ed25519 signing key
+gcloud kms keys create mykey --default-algorithm=ec-sign-ed25519 --purpose=asymmetric-signing --keyring=mykeyring --location=global
+
+# Enable Application Default Credentials (ADC) so the publisher tool can sign
+gcloud auth application-default login
+
+# Attempt login to show the public key
+mcp-publisher login dns google-kms --domain=example.com --resource=projects/myproject/locations/global/keyRings/mykeyring/cryptoKeys/mykey/cryptoKeyVersions/1
+
+# Copy the "Expected proof record" and add the TXT record
+# example.com. IN TXT "v=MCPv1; k=ed25519; p=PUBLIC_KEY"
+
+# Re-run the login command
+mcp-publisher login dns google-kms --domain=example.com --resource=projects/myproject/locations/global/keyRings/mykeyring/cryptoKeys/mykey/cryptoKeyVersions/1
+```
+
+**Setup:** (for Azure Key Vault signing)
+
+This requires the [Azure CLI](https://learn.microsoft.com/en-us/cli/azure/install-azure-cli?view=azure-cli-latest).
+
+```bash
+# log in and set default subscription
+az login
+az account set --subscription "My Subscription (name or ID)"
+
+# Create a resource group
+az group create --location westus --resource-group MyResourceGroup
+
+# Create a Key Vault
+az keyvault create --name MyKeyVault --location westus --resource-group MyResourceGroup
+
+# Create an ECDSA P-384 signing key
+az keyvault key create --name MyKey --vault-name MyKeyVault --curve P-384
+
+# Attempt login to show the public key
+mcp-publisher login dns azure-key-vault --domain=example.com --vault MyKeyVault --key MyKey
+
+# Copy the "Expected proof record" and add the TXT record
+# example.com. IN TXT "v=MCPv1; k=ecdsap384; p=PUBLIC_KEY"
+
+# Re-run the login command
+mcp-publisher login dns azure-key-vault --domain=example.com --vault MyKeyVault --key MyKey
+```
+
 #### HTTP Verification
 ```bash
 mcp-publisher login http --domain=example.com --private-key=HEX_KEY [--registry=URL]
@@ -119,6 +176,7 @@ mcp-publisher login http --domain=example.com --private-key=HEX_KEY [--registry=
 - Verifies domain ownership via HTTPS endpoint  
 - Grants access to `com.example.*` namespaces
 - Requires Ed25519 private key (64-character hex) or ECDSA P-384 private key (96-character hex)
+  - The private key can be stored in a cloud signing provider like Google KMS or Azure Key Vault.
 
 **Setup:** (for Ed25519, recommended)
 ```bash
@@ -140,6 +198,8 @@ openssl genpkey -algorithm EC -pkeyopt ec_paramgen_curve:secp384r1 -out key.pem
 # Content: v=MCPv1; k=ecdsap384; p=PUBLIC_KEY
 ```
 
+Cloud signing is also supported for HTTP authentication, similar to the DNS examples above. Just swap out the `dns` positional argument for `http`.
+
 #### Anonymous (Testing)
 ```bash
 mcp-publisher login none [--registry=URL]