gpg: Make trusted-key override for Tofu robust against swapped tofu.db.

* g10/tofu.c (get_trust): For the UTK check lookup the key by
fingerprint.

Extracting the keyid form the fingerprint is not a good idea because
that only works for v4 keys. It is also better to first read the key
and then extract the keyid from the actual available key.

The entire trusted-key stuff should be reworked to make use of
fingerprints.

• Signed-off-by: Werner Koch <wk@gnupg.org>