Refuse to certify revoked or expired keys

Certifying expired keys is technically possible with gpg, but (currently)
not with gpgme, and it makes little sense. Instead of running into a
confusing error we inform the user that they cannot do this.

GnuPG-bug-id: 6155