add trusted key store

needs docstring :-)

also "prefix" could do with some sanitisation (e.g. don't want "../../foo"); AIUI we could just ensure it is a `schema/types.ACName`?