sq keyring filter should expose the same interface as sq export

We should merge sq keyring filter and sq export. Perhaps it even makes sense to retire sq keyring filter once we support specifying keyrings on the command line in addition to the certificate store.