Consider removing dependency on external GPG installation for CreateCommitSignature

Everyone can contribute. Help move this issue forward while earning points, leveling up and collecting rewards.

• Work on this issue
• Close this issue

As referenced in https://gitlab.com/gitlab-com/gl-infra/scalability/-/issues/259#note_330564176.

The concern is that using_tmp_keychain is single-threaded and this may be causing the create_commit_signature worker to saturate its queue. This issue is intended to explore the possibility of getting rid of the GPGME dependency.

@nick.thomas has suggested that https://godoc.org/golang.org/x/crypto/openpgp may be enough to perform the operations needed.