This adds a new hardware-backed key and revokes two commit signing keys that were accidentally copied to a device without full disk encryption.