keys: move signing part out of find_by_thp() and to find_jws() (#81)

Handle just signing keys in find_jws(), to make sure we are
responding only to proper queries.

Tests were also failing to detect this issue and were updated
accordingly.

Issue discovered by Twitter Kernel and OS team during a source
code audit while evaluating Tang/Clevis for their needs.

Fixes CVE-2021-4076