Add comment to ignored-key

[vlsi]

For instance, mention artifacts that used the key.
Alternative (or additional) option is to add <dependency><ignored-pgp> tag so it is clear which dependency should be updated when key becomes "un-ignored"