Key rotation with VerificationKeySet

[mfridman]

I wanted to see what this looked like by taking #328 and then adding a PublicKeyset with a well-defined set of keys.

Most of this is recommendations from @oxisto and piggybacked on #328.

---

Update 2023-09-13

This PR introduced a "verification key" interface type to use as a type constraint:

type VerificationKey interface {
    crypto.PublicKey | []uint8
}

As well as a "verification key set" struct the parser asserts as the return from Keyfunc.

type VerificationKeySet struct {
    Keys []VerificationKey
}

Keys will be tried one by one until all keys are exhausted or a valid key is found and .Verify returns a nil error.

If all keys are tried and all fail, only the last error is returned, they are not joined. It is an error to supply a valid VerificationKeySet with no keys.

[mfridman]

@oxisto can we tune coveralls threshold?

coverage/coveralls — Coverage decreased (-0.02%) to 86.147%

Maybe if we can set it to 1% or something more sane?

[oxisto]

@oxisto can we tune coveralls threshold?

coverage/coveralls — Coverage decreased (-0.02%) to 86.147%

Maybe if we can set it to 1% or something more sane?

Yeah -1 % or maybe -0.5% sounds reasonable
Update: I changed the coverall settings, should hopefully apply in the next CI run

[oxisto]

I like the idea very much. Some smaller naming issues we should work out beforehand.

[schmidtw]

This is more clear than #328 .