Don't allow key generation for invalid roles

Signed-off-by: Lewis Marshall <lewis@lmars.net>
Coerce expiry times to UTC

Signed-off-by: Lewis Marshall <lewis@lmars.net>
Create the staged/targets dir if missing

Signed-off-by: Lewis Marshall <lewis@lmars.net>
Fix key JSON serialization

Signed-off-by: Lewis Marshall <lewis@lmars.net>