More closely integrate with GnuPG's keyring

• When a certificate is removed using TB, we could also remove it from the user's GnuPG keyring.

• When a certificate is updated, we could also update the version in GnuPG.

etc.