clientupdate/distsign: use distinct PEM types for root/signing keys (#9045)

To make key management less error-prone, use different PEM block types
for root and signing keys. As a result, separate out most of the Go code
between root/signing keys too.

Updates #8760

Signed-off-by: Andrew Lytvynov <awly@tailscale.com>

clientupdate/distsign/roots.go

@@ -41,7 +41,7 @@ func parseRoots() ([]ed25519.PublicKey, error) {
 		if err != nil {
 			return nil, err
 		}
-		key, err := parseSinglePublicKey(raw)
+		key, err := parseSinglePublicKey(raw, pemTypeRootPublic)
 		if err != nil {
 			return nil, fmt.Errorf("parsing root key %q: %w", f.Name(), err)
 		}