Restructure the repository

- Make OpenPGP only one of many protocols
  + KEYS.md only holds the current keys
  + OPENPGP.md describes all OpenPGP details
- Make the current public key available at the root
- Add scripts/ to automate the various steps:
  + bootstrap.sh
  + publish.sh
  + sign.sh
  + snapshot.sh
  + verify.sh

scripts/sign.sh

@@ -0,0 +1,49 @@
+#!/bin/sh
+
+# Create detached signatures for the signed documents in this repo
+#
+# Usage:  ./scripts/sign.sh [FILE...]
+#
+# FILE defaults to KEYS.md OPENPGP.md
+#
+# Writes FILE.asc next to each FILE and verifies it
+
+set -eu
+
+
+# Internal [S] subkey; pinned with "!" below so `gpg` never picks another subkey
+SIGNING_KEY='D6D1989DF1F6B23FD776293DB46EDB4DFC26805D'
+
+
+REPO=$(cd "$(dirname "$0")/.." && pwd)
+
+
+if [ $# -eq 0 ]; then
+    set -- \
+        "$REPO/KEYS.md" \
+        "$REPO/OPENPGP.md" \
+        # Keep this list aligned with the documentation at the top
+fi
+
+
+for FILE; do
+
+    if [ ! -f "$FILE" ]; then
+        echo "Error: $FILE not found" >&2
+        exit 1
+    fi
+
+    gpg --armor \
+        --detach-sign \
+        --digest-algo SHA512 \
+        --local-user "${SIGNING_KEY}!" \
+        --yes \
+        --output "$FILE.asc" \
+        "$FILE"
+
+    gpg --verify "$FILE.asc" "$FILE"
+
+    echo "Signed $FILE"
+    echo ""
+
+done