KEYS: Add a 'trusted' flag and a 'trusted only' flag