we would previously copy the gpg.conf to the temporary keyring, which
works, but then when we actually sign the key, we iterate over the
secrets to figure out which key to use, and then the default-key
setting is ignored.

instead, we simply parse the gpg.conf by hand to detect the
setting. we could have used gpgconf, but this doesn't seem easier to
parse and adds yet another dependency. i would argue it is easier and
simpler to parse the config file than to shell out to yet another
obscure gpg command.

this is a finalization of #721599