fix signing user builds

When unzipping a target-files which has been signed with OTA key
replacement, you'll get "overwrite this file?" prompts because the key
files appear in the zip files twice.  Suppress these prompts.

Many developer phone products don't define PRODUCT_OTA_PUBLIC_KEYS, so
add a default key.

This change doesn't affect device code.