Check expiration of suitable subkey instead of primary key

The primary key may not be suitable for the desired usage, e.g. for
a default-generated OpenPGP key the primary key cannot be used for
encryption, so that checking the expiration of the primary key makes
no sense. We need to check the expiration of the encryption subkey(s).

Additionally, allow checking certification keys for expiration.

GnuPG-bug-id: 6330