Support undoing removal from backups

Undoing a removal should be possible using the backups generated during the removal. Probably the best course of action is to add a new command swh alter restore.

The private key needed to decrypt the manifest should be split between multiple parties to ensure removals happen after a validation process. Some research needs to be done on what the user journeys should be.