Fix possibly leaking stdout
Change the default keyrings path

This is due to a conflict with gnome-keyring.

gnome-keyrings will use the directory we create for secret
storage, if it exists, but it won't migrate its existing
data.  So avoid putting public GPG keyrings in a directory
that may also contain secrets, and don't tickle g-k's
misguided heuristics.

Keep the other dir in the search path so that existing
downloads can be used.
Wrap most of the flow in an ExitStack context

Save ad-hoc exports of local keys into a temporary directory
rather than the public-keyrings dir.
Factor keyring-related things into a new class