LGTM=bradfitz R=rsc, bradfitz CC=golang-codereviews https://golang.org/cl/167190043
My goal here is to allow read-only access to legacy key material without allowing new V3 keys or signatures. R=agl CC=golang-dev https://golang.org/cl/12746046