expired-pgp-keys: Detect keys nonconforming to crypto policy

[jan-kolarik]

Looking at the expiriation date will miss what I think is the more common issue just now: all the obsolete SHA1 based signatures that will fail in various other ways. Sequoia generally defers this checking to verify rather than import time, but you might want to additionally call pgpPubKeyLint() on the key material to catch at least some of those issues too.

Originally posted by @pmatilai in #1592 (comment)