Finalize provision scripts

• Warn if there are more than one yubihsm plugged in (>1 is not supported)
• Error if a yubihsm-connector is running (each scripts starts and stops it)
• Make a test signature and verify it with openssl (sanity check)
• Save witness/log public key on the USB sticks (for convenience)
• Split up serial number + passphrase into two separate lines in output for logsrv/witness (consistent with how it is for backup output)
• Print manual santity check hints (like diff -u)
• Bring getting started document up to date. Including dropping output from scripts, because it's easier to ensure the README is up to date then.