add trusted key store

hrm, should we cache this for the life of a Keyring?