Update existing source reply keys to prevent leaking timing information

[garrettr]

Description

Follow-up to #3912, specifically #3912 (comment) and subsequent comments.

[garrettr]

There are (at least) two sources of sensitive timing metadata in GPG keys that we would like to obfuscate: the creation date and the expiration date. Initially, I was hoping we could just update the metadata of the existing keys, because I knew the expiration date may easily be changed with gpg --edit-key if one can access the private key. Unfortunately, some Internet research suggests the creation date cannot be changed.

I think that leaves us with the following possible, though slightly more complex, approach:

1. When a source logs in, check to see if their reply key ought to be replaced (e.g. has an expiration date, does not use the fixed creation date).
2. Generate a new reply key that does not leak timing metadata.
3. Use the old reply key to decrypt all of their currently stored replies.
4. Re-encrypt them with the new reply key
5. Delete the old reply key