chore: remove the 16 inline nolint directives

Type: chore

The need

go/signing carries 16 inline //nolint directives. Inline suppression is forbidden across this estate: a linter finding is either a real defect to fix or a rule that does not apply here, and the second case belongs in .golangci.yaml where it is reviewable in one place rather than scattered through the source.

This surfaced while clearing the same debt from go/encryption, which went from 28 inline directives to zero — mostly through real fixes rather than relocation. The same treatment is very likely to find real defects here.

Why this is not merely tidiness

In go/encryption, one of these was hiding a genuine security failure:

defer body.Close() //nolint:errcheck // the read below is what matters.

The comment was confidently wrong. In go-crypto, Close() is the OpenPGP modification-detection check — so tampered ciphertext decrypted silently and the command exited zero. The linter was right and the directive overrode it.

A //nolint is an assertion by whoever wrote it, checked by nobody afterwards.

What is here

Linter	Count	Shape
gosec	9	4× WKD SHA-1, 4× file permissions/paths, 1× os.ReadFile on an operator path
gochecknoglobals	6	the backend registry, size bounds, compile-time defaults, sentinel errors, test fixtures
nilnil	1	a test stub

Full list:

registry.go:11                gochecknoglobals  backend registry
signing_test.go:26            nilnil            test stub
local/local.go:72             gosec             os.ReadFile, operator-supplied path
openpgpkey/wkd.go:5,252       gosec             SHA-1, WKD bucket id
openpgpkey/wkd.go:179,194,225 gosec             world-readable WKD payload
openpgpkey/zbase32_test.go:4,25,83  gosec        SHA-1, per wkd.go
verify/signing.go:31,46,73    gochecknoglobals  size bounds, defaults, sentinels
verify/signing_wkd.go:262     gochecknoglobals  internal sentinel
verify/signing_test.go:20     gochecknoglobals  shared test fixtures

Suggested approach

What worked on go/encryption, in order of preference:

1. Fix the finding. Most gosec integer/permission complaints are real missing validation. A small internal num package with checked narrowing (U8/U16/U32) replaced 19 unchecked conversions there and turned asserted bounds into checked ones.
2. Remove the need. Two gochecknoglobals disappeared entirely when specification tables became switch statements. Sentinel errors are gochecknoglobals-exempt by configuration in most setups — worth checking whether the rule is even correctly configured before suppressing.
3. Move to .golangci.yaml, file-scoped, with the reasoning written down. Only for the genuinely irreducible: the WKD SHA-1 is a good example, and this repository already has a config exclusion for exactly that at verify/signing_wkd.go — so four of the nine gosec directives may be duplicating an exclusion that already exists.

That last point is worth checking first; it may be the cheapest win here.

Not in scope

Behavioural change. This should be defect-fixing and suppression-relocation only, with the test suite unchanged in what it asserts.