I would like to deploy OpenSSL, curl and perhaps other libraries as shared libraries in my package. I am a little worried that the someone may replace them with his own and "read" all my data, therefore I thought perhaps signing them would be an idea. Is this allowed?
P.S. I've read their licenses but there is no specific mention about this, so better to ask.
A signature is a non-reversible (but verifiable) cryptographic transformation on some input data. Signatures are not copyrightable since
Thus, anything a copyright license has to say about what the copyright holder allows you to do does not pertain to the creation of a cryptographic signature. In copyright terms, its analogous to the creation of a cryptographic hash. (And in case you're wondering if copyright can disallow you from distributing a hash: no, it cannot; you are always allowed to do that under copyright.)
As for whether or not you are allow to attach a signature to a binary (as opposed to keeping it separate), that's perhaps a slightly different legal question. That might or might not create a derivative work (even though the signature itself is devoid of copyright, some jurisdictions might view such an alteration as a derivative), but even if it is, any open source or free software license will allow you to make and distribute such an alteration.
In case you are concerned that your production of a signature might misrepresent you as the author of the work, that's usually not what signatures are for. In most environments, signatures just say, "Entity X had access to this work and asserts its contents are Y." After a recipient verifies the cryptographic validity of the signature and sees that the contents of the file are indeed still Y, the recipient can be sure it has not been changed from how it looked when Entity X had it, even if it first passed through the hands of Entities W and Z.
Under this paradigm, no one ever asserted that Entity X was the author of the file. We can only be sure that Entity X had access to the file and chose to make a cryptographically unforgeable assertion about the state of the file at that time.
It's possible that you might sign some kind of certificate document that does convey semantics that, e.g., you are the original author or copyright holder of a work. Obviously, it is not legal to make such an assertion if it's not true. But a signature, as a cryptographic tool, is agnostic to such an assertion and, furthermore, such an assertion is different from how signatures are used, practically, in code-execution contexts.
