feat(contrib): add ping key revocation helper

- Add make_ping_key_revocation.py: onion revocations are signed by the
  identity key, DNS TXT revocations are self-signed by the revoked key
- Document the revocation format, endpoint, helper usage, lifetime and
  no-revocation-of-identity-key limits
- Update the security audit, references and env docs for the new flow and
  the v2/onion-only scope

.env.example

@@ -55,8 +55,9 @@ WELIST_SERVER_URL=https://welist.bitcoin-after.life
 # validated `_welist-key.<host>` TXT record (or a v3 onion address). Omit or
 # set to 1 for the legacy scheme.
 WELIST_PING_SIG_VERSION=2
-# Onion hosts only: delegation certificate issued offline by the onion identity
-# key. SSL_KEY_PATH is then the dedicated ping key, not the identity key.
+# Onion hosts only (v2 pings): delegation certificate issued offline by the
+# onion identity key. SSL_KEY_PATH is then the dedicated ping key, not the
+# identity key.
 # WELIST_PING_DELEGATION_FILE=/var/bal/onion-delegation.json
 
 # ZMQ endpoints per network (default: localhost only)