we fingerprint the *public* key, not the private one

Fixing a simple typo/thinko in the blog post.