Removes old release signing key from securedrop-keyring

[zenmonkeykstop]

Status

Ready for review.

Description of Changes

Towards #5923 .

Removes the key with fingerprint 22245C81E3BAEB4138B36061310F561200F4AD77 from the keyting installed by the securedrop-keyring package.

Testing

• Ensure that there is only one key in the securedrop-keyring keyring, with fingerprint 2359E6538C0613E652955E6C188EDD3B7B22E6A3
• Ensure that this key was used to sign the transition statement in Rotate the SecureDrop Release Signing Key #5923
• make testinfra passes against a staging environment built from this branch.

Deployment

• fresh 2.0.0 installs will receive only the new key by default
• instances on 1.8.2 already have both keys - if the repo Release file is signed with either apt operations will work, the keyring package will be updated successfully, and other packages should also be fine regardless of installation order.

Checklist

If you added or removed a file deployed with the application:

If you made non-trivial code changes:

• I have written a test plan and validated it for this PR

Choose one of the following:

• I have opened a PR in the docs repo for these changes, or will do so later
• I would appreciate help with the documentation
• These changes do not require documentation

[conorsch]

We've discussed including this change for v2.0.0, but decided against it: right now, the prod Release file is still signed with the old key, so let's continue to honor that config until we've shipped v2. Then we can follow up in the n+1 release and pull in the changes presented here, as well as yanking out the dual-key logic in e.g. the Tails Workstation admin logic.

[conorsch]

Testing locally:

$ mkdir -m 700 -p /tmp/sd-keyring-test
$ gpg --homedir /tmp/sd-keyring-test --no-default-keyring --import install_files/securedrop-keyring/etc/apt/trusted.gpg.d/securedrop-keyring.gpg gpg: keybox '/tmp/sd-keyring-test/pubring.kbx' created
gpg: /tmp/sd-keyring-test/trustdb.gpg: trustdb created
gpg: key 188EDD3B7B22E6A3: public key "SecureDrop Release Signing Key <[email protected]>" imported
gpg: Total number processed: 1
gpg:               imported: 1
$ gpg --homedir /tmp/sd-keyring-test --no-default-keyring --keyring /tmp/sd-keyring-test/pubring.kbx -k
/tmp/sd-keyring-test/pubring.kbx
--------------------------------
pub   rsa4096 2021-05-10 [SC] [expires: 2022-07-04]
      2359E6538C0613E652955E6C188EDD3B7B22E6A3
uid           [ unknown] SecureDrop Release Signing Key <[email protected]>
sub   rsa4096 2021-05-10 [E] [expires: 2022-07-04]
$

That's what we want!

[conorsch]

Looks good, let's queue it up for 2.1.0.