Do not fail initialization if signing key has expired

[RLRabinowitz]

OpenTofu Version

1.6.0-alpha3

OpenTofu Configuration Files

...tofu config...

Debug Output

.

Expected Behavior

Running tofu init should not fail if one of the providers' signing keys are expired

Actual Behavior

Running tofu init does fails if one of the providers' signing keys are expired

Steps to Reproduce

tofu init on a configuration that includes a provider that has been signed by expired signing keys

Additional Context

go-crypto is making the GPG key expiry validation for tofu. We'd need to either pick a different package, or to somehow skip this validation / display a warning instead of an error.
An expired key should not fail tofu init

References

• Related issue in the Terraform repository: Terraform rejects expired signatures when downloading providers through registry hashicorp/terraform#33984
• Related issue regarding the current behaviour of having the GPG key validation not be mandatory - RFC: Provider GPG Key Handling in OpenTF Registry: Temporary Non-Failure Response to Missing Public Keys #266

[Yantrio]

We had a discussion around this one here: #673 . And In my opinion whilst the conversation didn't carry on much, I think there was a general concensus: Overtime we should get stricter.

I'd love to propose that we do the following (instead of just allowing it):

For the stable release (this issue)
Allow expired gpg keys for now, but display a warning.

For the next release
Add an opt-in variable that forces a stricter mode of verification (allow by default, disallow expired keys if the var is true)

For a future release
Look into asserting validation of provider signings by combining both the expiry of the key along with other factors (Generation of sig file, time of provider artifacts being generated, etc etc)

For reference, here's some comments/ideas on this:

• GPG Key Expiration Strategies in OpenTofu: A Call for Community Input #673 (comment) @cipherboy discussing attack vectors and even possibilities around keyless approaches
• GPG Key Expiration Strategies in OpenTofu: A Call for Community Input #673 (comment) @pdecat mentioning that we could take the github release asset creation date into account.

WDYT @cube2222 @RLRabinowitz