move to new signing keys

[Antoine Martin]

Instead of signing the packages with my personal key, create a new one (stronger too) for the project and ensure that other trusted developers can take it over if needed.
(and store it on a hardware token to keep it safe)

The difficult part is going to be the transition, as packages can only be signed by a single key.
New packages could just add the new signing key to the system (ie: rpm --import) and eventually (6 months?) we can switch over to the new key without causing too many problems?

[Antoine Martin]

(doing this ticket only after #2967)

Links:

• ​YubiKey-Guide
• ​gpg2: How to get rid of “Please insert card with serial number”, getting the same key from a different card / Yubikey (need with Fedora 33 and multiple yubikeys with the same keys on them)
• ​How to manage multiple GitHub accounts on a single machine with SSH keys
• ​What is the Git equivalent for revision number?

[migration script]

this ticket has been moved to: ​https://github.com/Xpra-org/xpra/issues/2968