Public keys for signed policy bundles

The Ed25519 public keys, as a JWKS, that sign policy bundles for the edge evaluator. An edge evaluator release pins these keys at build time; during a signing-key rotation the previous key stays listed until the bundles signed with it have expired. The kid in a signed bundle's protected header names the key to use.