Update bootstrap root keys

Johan Tibell is not part of the signing process anymore, so his key is
removed.

I've also annotated the keys with their owners and public keys,
because every time we consult this, I end up spending a bunch of time
in a scratch buffer correlating key IDs, public key values, and
ownership attestations. Might as well save the work for next time,
with appropriate disclaimers added.