Separate the kernel signature checking keyring from module signing so that it
can be used by code other than the module-signing code.
Signed-off-by: NDavid Howells <dhowells@redhat.com>