Sign and verify manifests in Go with OpenPGP instead of running gpg (closes #181)

mfer ran the gpg binary to sign, export keys and verify, so signing and
loading signed manifests failed wherever gpg is missing. It now uses
github.com/ProtonMail/go-crypto/openpgp. --sign-key and MFER_SIGN_KEY
name a file holding one OpenPGP secret key; a protected key's passphrase
comes from MFER_SIGN_KEY_PASSPHRASE or a prompt on the terminal.
Verification keeps the rules of the --require-signature fix: one primary
key in the embedded block, counted from its packets so that keys the
library skips count too, exactly one signature, made by that key or one
of its subkeys, and signer equal to its fingerprint. Tests make their
keys in process.

Model: opus-5-5

internal/cli/fetch_test.go

@@ -1191,20 +1191,23 @@ func TestFetchIntoDest(t *testing.T) {
 // with check's message before it downloads or writes anything; the
 // required key lets it through. A manifest signed by another key whose
 // embedded public key block also holds the required key must stop fetch
-// too. The signed cases need gpg and are skipped without it, as the other
-// signing tests are.
-//
-//nolint:paralleltest // signedManifest calls t.Setenv, which bars t.Parallel
+// too.
 func TestFetchRequireSignature(t *testing.T) {
+	t.Parallel()
+
 	files := map[string][]byte{testFileTxt: []byte("signed file")}
 
 	t.Run("unsigned", func(t *testing.T) {
+		t.Parallel()
+
 		assertFetchRefused(t, manifestOf(t, files), files,
 			"manifest is not signed, but signature from "+msgFpA+" is required",
 			"--"+flagRequireSignature, msgFpA)
 	})
 
 	t.Run("signed", func(t *testing.T) {
+		t.Parallel()
+
 		manifest := signedManifest(t, files)
 
 		signer := string(signedChecker(t, manifest).Signer())
@@ -1227,6 +1230,8 @@ func TestFetchRequireSignature(t *testing.T) {
 	})
 
 	t.Run("signed by another key embedded after the required one", func(t *testing.T) {
+		t.Parallel()
+
 		manifest, required := manifestSignedByAnotherKey(t, files)
 
 		assertFetchRefused(t, manifest, files,