Update local OpenPGP certificate to include new signing subkey.
Lock sources to tag object (by git commit hash).
Add `pkgver()` function since we are building from git sources.
Switch to correct SPDX license identifier for project.
Run tests with one job to (hopefully) mitigate flakiness.
Remove unused patches and build using LTO again (since the toolchain issues seem to be fixed).