GPG subpackets for metadata

It looks like there's a lot of information on a Keybase user's page to which the only attester is Keybase. Users seem to have an avatar, a long-form name, a bio and so on. This is confusing. There's no way to verify this information. Keybase hasn't, it's just that someone who signed up on the web _told_ keybase that _this_ key is associated with _that_ person. This seems silly.

Even more exciting, if someone attacks keybase's servers, they can change that information, and nobody would know!

Instead of relying on Keybase to maintain the validity of all the information on a user's profile page, use GPG subpackets (custom UIDs) to store it. GPG already has a sensible way to talk about images as UIDs. Other misc info like a bio could either be added as a binary UID type, or a long text UID. Links to a user's attestations on on accounts they control can also be added as UIDs.

This links all the information entered to a single GPG key. All the information Keybase displays would be verifiable, signed by that key. It also helps with federation (Issue #162). If users edit their profiles by adding information to their GPG key and uploading it to Keybase, there's one less thing on which Keybase is the sole authority.

This means that many different servers can display the same set of key information, without having to agree on a shared username/password authentication mechanism. There's no need for account-based authentication if everything is signed by the key which represents someone's identity.

The issue names no files, tests, or entry points. First clarify the GPG subpacket and custom UID format, the profile fields and attestation links to cover, and the Keybase integration scope; done means profile metadata can be verified from the associated key rather than relying solely on Keybase.

Written by the indexing model from the issue text.