Instance signing rule `pubkey` is described as "Only sign if the user
has a public key", however if the user only has SSH public keys, this
check will fail, as it only checks for GPG keys.
Changed the `pubkey` checks to call a helper `userHasPubkeys` which
sequentially checks for GPG, then SSH keys.
Related #34341
---------
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
