New options for `cf-key` to manage client keys

These two commits add options to `cf-key` to:

* print the digest of a `.pub` public key file
* copy a public key file to its trusted location

Both options are meant to be used in fully-automated installs,
where there is some trusted path to extract the key file from a
client and place it on the server, without the need to add a
`trustkeysfrom` line and restart the server.

The patches are in the `master` branch, but they apply cleanly 
to `3.3.x` as well.