apt: make trusted.gpg a conffiles so that apt-key added keys are preserved