Coupled with https://bugs.debian.org/899305 here I have another thing to
take note of:
 * keycheck should clearly check for different things for different
   processes (i.e., number of signatures)
 * also run keycheck for dc_ga, as we really want to block on small
   keys, or keys lacking the required capabilities, but we don't want it
   to show the non-required bits