Add (fake) CompOS key verification.

If we have a persisted key blob and public key for CompOS, but no
cert, then get CompOS to verify that they are genuine. If so, we can
generate a new cert for the public key. Otherwise we fall back to
generating a new keypair.

Once again I have made a few unrelated changes as I understand things
better.

Bug: 190166662
Test: Presubmit
Test: Manual - various valid & missing/invalid files.
Change-Id: I1bcb7f89698c103f413bdb899026bfd2578447db
4 files changed