Sign and verify manifests in Go with OpenPGP instead of running gpg (closes #181)

mfer ran the gpg binary to sign, export keys and verify, so it failed
wherever gpg is missing. It now uses github.com/ProtonMail/go-crypto/openpgp.
--sign-key and MFER_SIGN_KEY name a file holding one version 4 OpenPGP
secret key; a protected key's passphrase comes from
MFER_SIGN_KEY_PASSPHRASE or a terminal prompt. gen and freshen check that
the key can sign before they read any file. Verification keeps the rules
of the --require-signature fix: one primary key in the embedded block,
counted from its packets, exactly one signature, made by that key or a
subkey, and signer equal to its fingerprint. The embedded block may hold
no DSA key and no secret key, and an armored field must be one
well-formed block.

Model: opus-5-5

internal/cli/entry_test.go

@@ -654,11 +654,10 @@ func runCheckAfterRewrite(t *testing.T, rewritten, msg string) {
 
 // TestCheckRequireSignatureRefusesOtherSigningKey runs check
 // --require-signature on a manifest signed by another key whose embedded
-// public key block also holds the required key. check must refuse it. It
-// needs gpg and is skipped without it, as the other signing tests are.
-//
-//nolint:paralleltest // signedManifest calls t.Setenv, which bars t.Parallel
+// public key block also holds the required key. check must refuse it.
 func TestCheckRequireSignatureRefusesOtherSigningKey(t *testing.T) {
+	t.Parallel()
+
 	content := []byte("signed file")
 	manifest, required := manifestSignedByAnotherKey(t,
 		map[string][]byte{testFileTxt: content})