rebase-helper shouldn't let a user rebase when keys aren't enrolled

[castrojo]

We should make it so a rebase errors out with a similar warning to #1651 - that way gts users without signed keys don't rebase and boot into a busted system, helps mitigate:

#1636

[bsherman]

Not sure we want/can go so deep as to make an "rpm-ostree rebase" do that, but we could definitely do it with a ujust recipe.