One of the master keys depends on SHA-1, and nobody cares to update it. Let's ditch the master keys completely, sign and trust the builder key instead.