db-update: deny if packager key expires soon

We have troubles with expiring packager keys every now and then, especially some people just not acting on the issue.

Let's check for validity in the future, and deny to update if the key will expire withing 60 days.

This adds a dependency on libfaketime.