Support device keys generated and stored in the Secure Enclave feature of new Macs

New Macbooks, in particular the ubiquitous new M1 Macs, have a hardware secure element called [Secure Enclave](https://developer.apple.com/documentation/security/certificate_key_and_trust_services/keys/storing_keys_in_the_secure_enclave) for storing asymmetric keys.

While this is pretty useful for ssh keys (see [this project](https://github.com/maxgoedjen/secretive) making use of that), it has a limitation that makes it pretty difficult to use in the long-lived-offline-master-key model for GPG keys:

> The benefits of the Secure Enclave are balanced against a few restrictions. In particular, the Secure Enclave:
> - Can’t import preexisting keys. You must create keys directly inside the Secure Enclave. Not having a mechanism to transfer key data into or out of the Secure Enclave is fundamental to its security.

This makes it a particularly good fit for Keybase's "device keys" model, as far as I understand it; hardware keys scoped to the lifetime of the laptop could be signed and added to the chain of trust that Keybase users already use and verify. And Keybase already has (limited) support for adding "external" keys to that chain of trust, with `keybase pgp select`. However, I couldn't get that working, because there's no way that I could find to import my Secure Enclave keypair into GPG.

It seems like a little bit of glue would enable this way of doing things.

Start by investigating the existing `keybase pgp select` path and its support for external keys, then compare that flow with Secure Enclave keys generated on new Macs and the stated GPG import limitation. Done means defining and implementing a supported path for adding Secure Enclave device keys to Keybase's chain of trust.

Written by the indexing model from the issue text.