Support ed25519 keys for plugin signing

[tmccombs]

Introduction

The openpgp go package has been deprecated since 2021.

And it doesn't support ed25519 keys.

I ran into this because I followed the directions for creating a ruleset, but used an ed25519 key to sign it, and then tflint couldn't check the signature.

Proposal

Do one of the following:

1. Stabilize "keyless verification", and promote using that.
2. Replace the PGP signature method with another signature method (posibly using ed25519 directly)
3. Use a different PGP library that is actually maintained.

[bendrucker]

has been deprecated
Use a different PGP library that is actually maintained.

Advocate for this change on the merits.

Other than ed25519 signature support, are there other benefits we should care about?

[wata727]

I have considered migrating to a different PGP library in the past, but decided against it due to the incompatibilities that would arise from having to validate key expirations #1768

Given the incompatibility, I personally would like to consider promoting keyless verification.

[tmccombs]

I personally would like to consider promoting keyless verification.

I agree with this.