Restructure the repository

- Make OpenPGP only one of many protocols
  + KEYS.md only holds the current keys
  + OPENPGP.md describes all OpenPGP details
- Make the current public key available at the root
- Add scripts/ to automate the various steps:
  + bootstrap.sh
  + publish.sh
  + sign.sh
  + snapshot.sh
  + verify.sh

scripts/publish.sh

@@ -0,0 +1,59 @@
+#!/bin/sh
+
+# Publish the current OpenPGP public key to the keyservers
+#
+# Usage:  ./scripts/publish.sh
+#
+# Run after every change to the key
+#
+# Notes:
+#  - The SKS-style servers merge and never delete
+#    => Every change must be pushed
+#  - keys.openpgp.org strips UIDs until each address is verified
+#    => Click the links mailed to all addresses after new or changed UIDs
+#
+# Exits non-zero if any keyserver rejected the upload
+
+set -eu
+
+
+# Internal [S] subkey; only used to look up the key
+SIGNING_KEY='D6D1989DF1F6B23FD776293DB46EDB4DFC26805D'
+
+
+KEYSERVERS='
+    hkps://keys.openpgp.org
+    hkps://keyserver.ubuntu.com
+    hkps://pgpkeys.eu
+    hkps://pgp.mit.edu
+    hkps://keyserver.escomposlinux.org
+'
+
+
+# Notes:
+#  - the first fingerprint line is the primary key's fingerprint
+#  - a subkey resolves to it
+FPR=$(gpg --list-keys --with-colons "$SIGNING_KEY" \
+    | awk -F: '$1 == "fpr" { print $10; exit }')
+if [ -z "$FPR" ]; then
+    echo "Error: Key $SIGNING_KEY not found" >&2
+    exit 1
+fi
+
+
+FAILED=0
+
+
+for server in $KEYSERVERS; do
+
+    if gpg --keyserver "$server" --send-keys "$FPR"; then
+        echo "OK    $server"
+    else
+        echo "FAIL  $server" >&2
+        FAILED=1
+    fi
+
+done
+
+
+exit "$FAILED"