Verify the signature on dotfiles when creating a homedir

[KellerFuchs]

This is done in two steps:

1. make a world-readable, role-based, GnuPG keyring;
2. use it to check the signature of the git HEAD when cloning the dotfiles repo.

[KellerFuchs]

Don't merge yet, I forgot some etckeeper stuff.
Should be ready to go.

@lrvick Ping!

[daurnimator]

sane when you know use an empty

huh?

[KellerFuchs]

Oops, missing word in the comment.
Thanks

[KellerFuchs]

I tested it on my kellertest account (adapting the thing to have the keyring in ~/hashbang-admins.gpg, temporarily).

Both the “good” (valid signature) case and the “unknown signer” case work.
I didn't test the “no signature” case, but git verify-commit will also error-out on it.

[KellerFuchs]

@daurnimator Any comment, now that I fixed the missing word?

[daurnimator]

Can't see anything wrong with it.

Not something I see the point of; but whatever, merge it.

[KellerFuchs]

OK.

@daurnimator FYI, the point of hashbang/hashbang#14 is not to trust Github ultimately.
Of course, there is no point in taking care of dotfiles when shell-etc is also pulled from Github, I was just starting with the low-hanging fruit.