add trusted key store

No. It should not be run by an automated process. It's more of a helper to generate keymap.go. Ideally we will never touch it, but if we did the workflow would be as follows:

* Add a new key name to keygen.go
* Run go generate
* check in the results