feat(debian): use explicit, stronger defaults for newly generated repo signing keys

[0xMax42]

This PR updates Debian repository signing key generation to use explicit RSA-4096 defaults and to embed the creation time in the OpenPGP UID for newly created keys.

Rationale

Repository signing keys are typically long-lived. Since there is currently no built-in key rotation mechanism, the initial key parameters effectively persist for years.
At the moment, those parameters are implicitly derived from OpenPGP library defaults, which makes the effective crypto policy indirect and potentially subject to upstream library changes.

This change makes the defaults explicit and slightly more future-proof, without affecting existing repositories.

Changes

For newly generated Debian repository keys only:

• Add a UTC creation timestamp to the key comment

• Generate keys with an explicit packet.Config:

  • RSA 4096-bit primary key and encryption subkey
  • SHA-256 as default hash
  • AES-256 as default cipher

Compatibility

• Existing repository keys stored in the database are not modified
• Only newly created keys are affected
• RSA-based keys remain fully compatible with APT and GnuPG
• No changes to signing logic or repository metadata formats

Verification

The change was verified by generating a fresh keypair and validating InRelease signatures via gpg --verify.
Repositories using existing keys continue to work unchanged.

The diff is intentionally small and isolated to key generation only.

[delvh]

LGTM if renaming a user does not break anything.

[0xMax42]

Should I adjust the PR text above?

If I remember correctly, the title and the first line of the text will be included in a possible merge, correct?

[delvh]

Should I adjust the PR text above?

Yes, if you'd like to that would be very welcome.

If I remember correctly, the title and the first line of the text will be included in a possible merge, correct?

Exactly, except it's the PR title + entire description.