Add David's key

distribution packagers need to know who is authorized to sign tarballs because tor is quite important software to users.

With the release of 0.4.6.10, the signing changed, so please update gpg fingerprints on support.torproject.org