feat: add gpg-only-active-keys/ keyring

[aduh95]

My use case for this is that in nixpkgs, at any point in time we already have a verified hash for previous Node.js release, we only need to verify hash of "new" releases, so ideally it should fail if a new release is signed with a key listed as no longer active.

[richardlau]

I'm +1 to the idea -- it's not clear to me how we're going to be managing this key ring -- it looks like the cli.sh changes would add keys to both keyrings (which probably makes sense), but then how are we excluding keys (the non-active ones) from the the new keyring?

[aduh95]

I'm +1 to the idea -- it's not clear to me how we're going to be managing this key ring -- it looks like the cli.sh changes would add keys to both keyrings (which probably makes sense), but then how are we excluding keys (the non-active ones) from the the new keyring?

In #36, I'm adding:

• a workflow that would tell us when the keyring is not longer in sync with nodejs/node README.
• a script to regenerate both keyrings.

So when a key gets retired, we'd get a hint from CI to update the keyring, which we can either gpg --delete, or we can reganerate the keyring altogether.