Update keyring

This adds a new hardware-backed key and revokes two commit signing keys
that were accidentally copied to a device without full disk encryption.