Enforce signing of shell-etc

[KellerFuchs]

Currently, Github is ultimately trusted, since we pull configuration from it, build containers based on repo's contents, ... As a first step away from this (not from using Github, but from trusting it), I suggest we use OpenPGP signatures to protect the authenticity of the git tree.

This is (mostly) straightforward:

• Create a GnuPG homedir in /etc/gpg/, used only for signature checking.
  This allows us to keep the keyring and the GnuPG config (in particular, trust-model direct) in shell-etc.
• Agree to only merge PRs in shell-etc using signed merge commits, as can be created with git merge --no-ff -S.
  When switching to this practice, create an empty, signed commit at the head of shell-etc (if needed).
• Replace etckeeper vcs pull --ff-only in sync.yml with etckeeper vcs pull --ff-only --verify-signatures, with the GNUPG_HOME environment variable set to /etc/gpg/.

There are 2 main issues:

• It doesn't currently seem possible, on Github, to enforce that only signed commits get pushed.
  I've been in touch with Github's support regarding that.
• How do we deal cleanly with commits created by apt(8)?

[KellerFuchs]

By the way: the Git documentation is a bit vague, when it comes to --verify-signatures.
I experimented and checked the source to see how it behaves precisely, and sent a documentation patch upstream.

[KellerFuchs]

@hashbang/administrators We could actually enforce that only signed commits land in shell-etc:master:

• Setup mirroring from git-infra.hashbang.sh to Github, and use protected branches to ensure that only git-infra can push to master.
• Add a Git hook to reject unsigned heads on master (on git-intra).
• From then on, push our changes to git-infra.
• (Optionally) edit the etckeeper remote to pull updates from git-infra directly.

That's pretty much independent of the PR to close this, but that would avoid mistakenly pushing unsigned stuff to master.