update-authorized-keys: double the retry timer after every failure
update-authorized-keys: add some comments
update-authorized-keys: use --decrypt to verify and output in one step

This makes completely sure that only the signed data will be used as
part of authorized_keys.

I didn't want to use --decrypt, but then I realized I already use it
separately, so fuck it, adding --batch --yes should be enough.
update-authorized-keys: trivial syntax updates
update-authorized-keys: use a more precise time format