Signature validation depends on an externally provided keyring

[mdellweg]

This is bad for several reasons:

• The keyring must be provisioned and made available on all pulp nodes/containers/service units (installer nightmare).
• The repository serializer references a local file on the server to select the keyring (bad api).
• It is impossible to provide a key to verify against via the api.
• It is impossible to use an ephemeral keyring in the tests.

The proposed solution is to add a (text-)field on the repository that can hold a (maybe multiple) private key. Verification of an uploaded signature will then only depend on information in the applications database.