Support encrypting keys

[timbru]

Support encrypting keys stored in the key value store:

• use a configurable secret for en/decryption
• think of migrating existing keys, or;
• add config flavour for this and support through key-roll

This can help against some issues where a backup ends up in the wrong hands. But only if the encrypting secret is secure. So, probably only really adds value if that would be in some HSM device.