Automatically load encrypted private keys

With this release the signing daemon is able to load CA signing keys that had previously been encrypted using Amazon's KMS.