David Runge opened issue wiktor/ssh-openpgp-auth#34

To make sure we are producing something that is transparently packagable, we should integrate reuse and add SPDX license statements to all files.

As discussed over Matrix, we'll want to dual-license the code under Apache-2.0 OR MIT.