Update signing key in dom0

[conorsch]

Towards freedomofpress/securedrop#5923. In order to rotate the SecureDrop Release Signing Key on the workstation, we must add the public key to both dom0 & sys-firewall, so that qubes-dom0-update will continue to verify packages such as qubes-template-securedrop-workstation-buster.

Separately, we'll need to add the pubkey to the Debian-based TemplateVMs. That's tracked in freedomofpress/securedrop-builder#249. This ticket tracks the dom0 changes, which will also require a bump or resign of the RPM packages shipped for dom0.

[eloquence]

(I'll take a first stab at this tomorrow.)