signing-cli v0.6.0 advertised the --backend type:instance syntax but its
go.mod minimum (go/signing v0.7.0) predates the local factory, so a
consumer bumping only signing-cli got the flag without the capability and
a misleading "unknown signing backend type" for a registered backend
(found by go-tool-base against the released bits).

Raise the go/signing requirement to v0.8.0 so the local named path is
self-consistent, and enrich the resolver error: when a type is registered
as a default but has no factory, say so and point at the default / a
backend update, instead of claiming the type is unknown. A genuinely
unknown type still surfaces ErrUnknownBackendType. The aws-kms factory is
in signing-aws-kms — a separate module signing-cli cannot pin — so the
clearer error is the guard there. Per spec 0001.