Consider how to sign security.txt files intuitively

Branched out from #52

As introduced by securitytxt/security-txt#140, the Signature: directive is being replaced with inline signatures:

It is RECOMMENDED that a security.txt file be digitally signed using an OpenPGP cleartext signature as described in section 7 of {{!RFC4880}}. When digital signatures are used, it is also RECOMMENDED that implementors use the "Canonical" directive as per {{canonical}}, thus allowing the digital signature to authenticate the location of the file.

When it comes to verifying the key used to generate the signature, it is always the security researcher's responsibility to make sure the key being used is indeed one they trust.

I don't think it's okay to have the private key anywhere near the source code of the user, and I also think our package shouldn't need to even see the user's private key

I think we should provide a CLI for people to generate security.txt files. They can then use other tools to sign it and use existing methods to serve the file (or even add something to our library so that it can serve static files, and we could even validate the imported file).