Try to use a signing key via an experiment workspace (#699)

Here I'd like to try and make sure a contributor in a workspace cannot escalate access to its signing keys by way of being able to create experiment workspaces. I set up the skeleton of the test somewhat, but I lack debusine-fu to be able to make a serious attempt at it.