feat(contrib): add ping key revocation helper

- Add make_ping_key_revocation.py: onion revocations are signed by the
  identity key, DNS TXT revocations are self-signed by the revoked key
- Document the revocation format, endpoint, helper usage, lifetime and
  no-revocation-of-identity-key limits
- Update the security audit, references and env docs for the new flow and
  the v2/onion-only scope

docs/04_modules_detail.md

@@ -212,7 +212,9 @@ This is the async daemon that monitors the blockchain and pushes pending transac
     verifies at startup that it is bound to the configured onion host, has not
     expired, and delegates to the key at `SSL_KEY_PATH`. If that check fails the
     pusher disables delegation and signs directly, which the service rejects
-    unless `SSL_KEY_PATH` is the onion identity key.
+    unless `SSL_KEY_PATH` is the onion identity key. A leaked key is stopped
+    with `contrib/make_ping_key_revocation.py` (onion: identity-signed; DNS:
+    self-signed), submitted to the WeTime `/ping-keys/revoke` endpoint.
 - `bal-pusher.sh` pins `WELIST_PING_SIG_VERSION=1` for the development setup:
   a `localhost` URL cannot use DNSSEC, so the dev pusher uses the legacy
   scheme verified against `/.pub_key.pem`. v2 requires a public DNS hostname