Key replication with hardware token key wrapping

Nobody has claimed this yet.

This is a proposal to fix the problem described in #771 in a different way:

* Provide support for crypto tokens (such as the https://smartcard-hsm.com/) family, that are able to wrap and unwrap the keys safely.
* This way, the user could replicate the primary key onto multiple devices easily, without having to extract the key.

Rough steps (maybe this is a [project](https://github.com/osresearch/heads/projects)):

- [x] Update GnuPG to 2.3.+ #1350
- [ ] Better, universal token recognition (USB IDs, followed by Answer to Reset for smartcard-like tokens)
- [x] _Token recognition and initialization is very slow. Get rid of scdaemon internal CCID mode and let pcscd do the job?_ (This is unrelated to CCID, `kexec-sign-config` needs to be fixed - #1369).
- [ ] Re-think "screenscrapping" of gpg. Rough idea: gpg-connect-agent directly to the gpg agent, is gpg itself getting a decent Assuan server? https://git.gnupg.org/cgi-bin/gitweb.cgi?p=gpgme.git
- [ ] Fight scdaemon to get better control of the crypto hardware. Consider using the evil https://github.com/alonbl/gnupg-pkcs11-scd/
- [ ] Create key domains on https://smardcard-hsm.com/ on initialization. Implement DKEK support to wrap/unwrap GPG keys and replicate them.
- [ ] Key wrapping with AES for other tokens?

Start by reading the problem in #771 and the referenced work around kexec-sign-config, then review the unchecked steps in this proposal. Investigate token recognition, gpg-connect-agent or Assuan integration, scdaemon/pcscd behavior, and DKEK support. Done means a supported token can wrap and unwrap keys so the primary key can be replicated without extraction.

Written by the indexing model from the issue text.