add trusted key store

We should not write to `/usr` (nor can we on some systems). Rather than`DeleteTrustedKey{,System}Root`, we should have `MaskTrustedKey{,System}Root`, which creates an empty key in `/etc`.