Affirmation check still vendors expired web-flow key and conflates unknown keys with invalid signatures #60

The actions/affirmation-check key on main (c6f5b491618c62f27bdee2da81db50e191b1aa9c) is byte-identical to the historical web-flow key vendored as github-web-flow-previous.gpg by hyperpolymath/trope-checker PR #107; it differs from the current GitHub web-flow key. The main action also treats Git signature status E as bad/revoked/failed without distinguishing GnuPG NO_PUBKEY. This caused the trope-checker estate audit to fail and required a local workaround.

Please update the bundled GitHub key with verified fingerprint and preserve the historical key; differentiate unknown signing keys from invalid/revoked signatures without granting unknown signers trusted status. Add tests covering current and historical trusted keys, unknown keys, and bad/revoked signatures. Consumers can then pin the repaired action and remove their local workaround. See hyperpolymath/trope-checker#107 and its .github/affirmation-trusted/README.adoc.