rewrite update.go & signer.go to use more userfriendly signing process

[ZyanKLee]

Replace custom signing process in scripts/signer.go and update.go with well established format. Maybe even replace scripts/signer.go with the corresponding cli in the Makefile and implement verification in update.go

• x/crypto/openpgp: mark as frozen and deprecated golang/go#44226 (go module openpgp is not maintained, usage of crypto/ed25519 is suggested which lawl implemented in NoiseTorch)
• allow for easier verification outside of noisetorch (using cli for example)

See #310 for example of why the current process is not optimal since the existance of the signature file is now more apparent.

[ZyanKLee]

Just found golang/go#44226 which sadly states that the usage of the openpgp module for go is discouraged. Will need to look a little deeper into the matter and search for alternatives or even just a change in naming so it is more obvious how to use the signature.

[ZyanKLee]

Perhaps this can even be solved by documentation.
openssl/openssl#6988 (comment)

[AXDOOMER]

I found a solution which I think it's great.

I was looking at crypto libs and stumbled upon the Ethereum cryptographic algorithms for Go.

Repo: https://github.com/ethereum/go-ethereum

It's actively maintained. I found another replacement, but this one wasn't. So I suggest we avoid using PGP or GPG and go for ECDSA. There is a good article explaining how to implement it online and I'd like to implement it if we go forward with this solution. I believe it's a good choice: If it wasn't, lots of people would be at risk of losing lots of money.

I found that it also implements Ed25519, which according to this article is more secure. This is the algorithm we currently use. I also suggest we could pick this one to make things easier. Both algorithms bring good levels of security.

In case there are any incompatibilities, the current verification scheme and the new one could cohabit for a few months while people update their version of NoiseTorch. This will avoid new issues like #319. If we have to go this way, a message telling users to update as soon as possible should be displayed.

The latest release of Go allows to run .go files as scripts, for example go script signature.go noisetorchbinarypath which should be user friendly.