Better maintenance of PGP_KEYS file

We maintain a PGP_KEYS file in /downloads to allow deployers to verify package signatures made by our developers.

The process by which this file is maintained is a bit ad hoc at present: edit the file yourself, or get someone else to edit it. There's no audit, no history, no way of rolling back to a previous state if you blap someone else's key by accident.

Phil and I have been reviewing our keys amongst other things, so this has been top of mind. I'd like to propose that we improve this situation by moving the PGP_KEYS information into a new repository, then having the public file updated from that repository as a result of a post-receive hook.

I'd further suggest that we do not just move the PGP_KEYS file into the repository and call it good. Instead, I'd propose that the repository contain individual keys as .asc files, named after the developer and the key ID, e.g.:

(Or some other stable convention.)

In the post-commit hook, we'd then build the actual PGP_KEYS file available for download from those files, perhaps with a little blank space added between them. I'd sort the fragments by their original file name for stability. We might also add a header and trailer comment explicitly in the hook, or have another couple of .asc files named such that they fall in the right places in the sort order.

One might have some opinions about whether we can or should trim out some old keys at this point. In general, this isn't a great idea as our current PGP_KEYS file should really contain keys capable of verifying any old package signature that we still expect people to want to verify, which might end up being "all of them". This applies even if the key has since expired (but arguably not if it has been revoked... which is a good reason not to revoke old keys, of course). Either way, I'd suggest not tackling that question here, but just decomposing PGP_KEYS as it stands today.