Implement revocations

[renatav]

Once force pushing to/destroying an authentication repository completely is no longer an option, we need to be able to revoke the repository's commits.

• A revocation needs to be signed by a threshold of root keys
• We need to assume that another library (not us) downloaded certain changes before they were revoked.
• The updater should never delete something that was pulled down. Instead, we want to move revoked commits to a separate branch.
• The official repository should make it seem as that revoked branch never happened
• Any library that is authenticating things will not be able to authenticate a revoked commit if they didn't pull it down before it was revoked, so two different libraries might give different authentication results. How bad is that?
• Figure out where to store revoked metadata