Add a GPG public key for verifying signatures

The key is stored using a Web Key Directory, though unfortunately it
doesn't actually conform to WKD because DNS queries for
openpgpkey.loot.github.io don't fail. Despite that, I think it's still
as good a place as any to put the key.

.well-known/openpgpkey/policy

@@ -0,0 +1 @@
+# Policy flags for domain loot.github.io

_config.yml

@@ -9,3 +9,5 @@ plugins:
 
 whitelist:
   - jekyll-redirect-from
+
+include: [".well-known"]