Restructure the repository

- Make OpenPGP only one of many protocols
  + KEYS.md only holds the current keys
  + OPENPGP.md describes all OpenPGP details
- Make the current public key available at the root
- Add scripts/ to automate the various steps:
  + bootstrap.sh
  + publish.sh
  + sign.sh
  + snapshot.sh
  + verify.sh

scripts/bootstrap.sh

@@ -0,0 +1,72 @@
+#!/bin/sh
+
+# Set up a machine's keyring to verify everything in this repo
+#
+# Usage:  ./scripts/bootstrap.sh
+#
+# Imports the current public key and all historical keys,
+# trusts them ultimately, and runs ./scripts/verify.sh
+#
+# Notes:
+#  - Idempotent => Safe to re-run at any time
+#  - Touches public material only; the deployed secret subkeys
+#    come from Vaultwarden, see OPENPGP.md
+
+set -eu
+
+
+# Internal [S] subkey; only used to look up the key
+SIGNING_KEY='D6D1989DF1F6B23FD776293DB46EDB4DFC26805D'
+
+
+REPO=$(cd "$(dirname "$0")/.." && pwd)
+
+
+
+gpg --quiet \
+    --import "$REPO/public-key.asc"
+echo "Imported public-key.asc"
+
+gpg --quiet \
+    --import "$REPO"/history/*.asc
+echo "Imported history/*.asc"
+
+
+
+# Notes:
+#  - The first "fpr" line is the primary key's fingerprint
+#  - A subkey resolves to it
+FPR=$(gpg --list-keys --with-colons "$SIGNING_KEY" \
+    | awk -F: '$1 == "fpr" { print $10; exit }')
+if [ -z "$FPR" ]; then
+    echo "Error: Key $SIGNING_KEY not found" >&2
+    exit 1
+fi
+
+
+
+# Notes:
+#  - One "--import-ownertrust" call
+#    => `gpg` checks the trustdb only once
+#  - "--show-keys" reads a file without importing
+#    => Its warnings about revoked keys are expected and silenced
+
+TRUST=$(mktemp)
+trap 'rm -f "$TRUST"' EXIT
+
+echo "$FPR:6:" > "$TRUST"
+for FILE in "$REPO"/history/*.asc; do
+    gpg --show-keys --with-colons "$FILE" 2>/dev/null \
+        | awk -F: '$1 == "fpr" { print $10 ":6:"; exit }' >> "$TRUST"
+done
+
+gpg --quiet --import-ownertrust "$TRUST"
+sed 's/^/Trusted /; s/:6:$/ ultimately/' "$TRUST"
+
+
+
+gpg --check-signatures "$FPR" >&2
+
+echo ""
+
+"$REPO/scripts/verify.sh"