Document TUF artifacts

[jku]

We should include a short description of the artifacts in the README or in a separate file

• trusted roots (currently just one)
• signing configs (and who should be using which one)
• npm keys
• deprecated content

split from #1644