Does the fact that I sign and distribute runtime & SDK used to write the component oblige me to change the component's license to MIT / Apache2?
No, software under Apache 2 or MIT/Expat/X11 licenses may be used within software under virtually any license. These are "permissive" licenses which means they don't impose many requirements (other than attribution) and they don't require other code to be licensed in any particular way.
You should be aware that the GPLv2 imposes requirements when it is distributed with other code in such a way that it forms a derivative work: the whole new derivative work must be licensed under the GPL. The information you supply here doesn't clearly suggest that case is happening -- especially since you're packaging and distributing the components separately, and the GPLv2 component appears to be optional -- but I mention it because it is quite similar to the concerns you ask about in your first question here.
Is the signing of these packages allowed? Is it considered a modification?
Signing is allowed, and it is probably not a modification. Cryptographically speaking, a signature is the output of some operation Sign(input, private_key) => signature and it does not preserve any of the original expression of the input. A signature itself isn't a derivative work under copyright, and placing a signature (which has no creative expression) alongside a work probably doesn't make a derivative either.
You are absolutely allowed to produce and distribute a cryptographic signature by performing a Sign operation using some freely-licensed code as input. Even if it did result in a derivative work (which it does not), the licenses allow you to prepare and distribute derivative works.
Can I distribute signed packages? As far as I know, there are no limitations on distributing modified or unmodified versions of software in any of these licenses.
Correct, all free and open source licenses allow distribution of the licensed material in modified or unmodified form.
Do I need to distribute private keys used for signing as well?
No, you may keep your private key private.
The only possible way the answer to this might ever be "yes," is if
- You are using software under the GPLv3 (or AGPLv3),
- Embedded in a hardware device that can run modified code, and
- That device uses your signature to decide what code to run or not run (i.e., the device will refuse to run unsigned or wrongly-signed code)
in which case, the GPLv3 requires you to give users some way to produce their own valid signatures. From the information you've provided, you do not meet even one of these three criteria; you do not need to share your signing key.
