Key ACLs

Who may reach a key, and with which rights.

Operation	Auth	Purpose
POST /api/keys/acl/get	Bearer + DPoP	Read a key's ACL.
POST /api/keys/acl/grant	Bearer + DPoP	Add an ACL entry giving a principal rights over a key.
POST /api/keys/acl/update	Bearer + DPoP	Amend an existing ACL entry to a given rights mask.
POST /api/keys/acl/revoke	Bearer + DPoP	Remove a principal's ACL entry entirely.