[meta-issue] Push OEMs to maintain+ detach sign their ISOs and inlude their distro public key in tree

[tlaurion]

• Detach sign iso with nitrokey key and have public key under Heads oem. Remove all other grub entries then nitrokey oem installer Nitrokey/qubes-oem#20
• Detach sign iso with nitrokey key and have public key under Heads oem. Remove all other grub entries then nitrokey oem installer Nitrokey/ubuntu-oem#11
• @JonathonHall-Purism pureos key in tree but no detached signatures Removed in PR keys: Remove PureOS signing key #1746
• others?

[tlaurion]

Also think of a mechanism to check public keys against their expiration date, warning of expiration proactively in CI.
Tails is becoming an issue as per last pr #1631

Track ben-grande/qusal#46 since I have no clue how to efficiently do that