Currently both `ci` and `rhel` targets copy the same "mix two keys" code. We should have a `hack/generate-configmap.sh` which generates both configmaps - and a presubmit job which ensures its generated correctly.

Using a script is preferable, as CI container may not have `make`

Previous work:

• https://github.com/openshift/release/pull/10064
• https://github.com/openshift/cluster-update-keys/pull/16