This is a "more correct" API and we might as well fix this before it becomes
used all over the place. The new API returns ErrNoPublicKey when there is no
inlined key.
This *also* fixes a bug where the datastore-backed keystore would panic if
`ExtractPublicKey` returned `nil, nil`.