Add security.txt

- Add scripts/security-txt.sh
  to generate a security.txt file
- Add the current security.txt
- Extend verify.sh to verify security.txt by default
  and cross-check that it expires together with the signing key
- Describe security.txt in OPENPGP.md and README.md

README.md

@@ -39,6 +39,7 @@ gpg --import public-key.asc
 gpg --verify KEYS.md.asc KEYS.md
 gpg --verify OPENPGP.md.asc OPENPGP.md
 gpg --verify AGE.md.asc AGE.md
+gpg --verify security.txt
 ```
 
 Each `gpg --verify` will print two things:
@@ -89,6 +90,8 @@ How I implement [OpenPGP](https://www.openpgp.org/):
   Detached signature, renewed at every ceremony
 - [`public-key.asc`](public-key.asc):
   Armored export of the current OpenPGP key
+- [`security.txt`](security.txt): [RFC 9116](https://www.rfc-editor.org/info/rfc9116/)
+  contact file, clearsigned, renewed at every ceremony
 - [`snapshots/`](snapshots/):
   Yearly exports of the current OpenPGP key
 - [`ceremonies/`](ceremonies/):
@@ -125,8 +128,10 @@ Besides OpenPGP,
 - [`verify.sh`](scripts/verify.sh):
   Verifies all signed files against the pinned signing subkey,
   warns when the key is about to expire, and
-  cross-checks `age-recipient.txt`
+  cross-checks `age-recipient.txt` and `security.txt`
 - [`snapshot.sh`](scripts/snapshot.sh):
   Exports the current key to `snapshots/` and `public-key.asc`
 - [`publish.sh`](scripts/publish.sh):
   Pushes the current key to the keyservers
+- [`security-txt.sh`](scripts/security-txt.sh):
+  Generates and clearsigns `security.txt`