add support for managing opengpg keys and ACI signature validation

This patch adds support for managing trusted opengpg keys in a keystore backed
by the local filesystem. Trusted keys are stored in following directories by
default:

* /etc/rkt/trustedkeys/root.d
* /etc/rkt/trustedkeys/prefix.d
* /usr/lib/rkt/trustedkeys/root.d
* /usr/lib/rkt/trustedkeys/prefix.d

Each trusted key is stored using the key fingerprint as the name and the key
in OpenPGP ASCII Armor format as the contents.

OS vendors can store system-wide trusted keys in the trusted keys directories
under /usr, which can be overridden by creating an empty file under /etc with a
matching name (fingerprint).

This patch also adds support for validating ACI signatures against trusted keys
found in the local keystore.

Fixes #215