sig.db is a file that contains a list of game save filenames and the ECC signatures of those save files. Every time a game is exited, its save file is copied back to NAND, signed with ECDSA, and the signature stored in sig.db. This is presumably to prevent altering save files externally.
However, it seems that saves can actually be altered freely and the signing of saves is pointless:
If a save's signature is found to be invalid, the only effect is SA simply does not re-sign the save when it is next copied back to NAND. This means the validation of a save's signature has no bearing on whether or not the save can be used.