Begin with root key index when reading keystores.

Instead of using the zero value, explicitly set the last chain index
to -1, which represents the root key.  If no additional keys are read
from the io.Reader, this could result in panics when looking up keys
at index 0, when no additional keys have been created yet.

Fixes #119.