Key lifecycle

Creating, reading, exporting and expiring keys.

Operation	Auth	Purpose
POST /api/keys/template	Bearer + DPoP	Mint a key from a named template, or from the default one.
POST /api/keys/get	Bearer + DPoP	Read a key's metadata by hidden link.
POST /api/keys/export	Bearer + DPoP	Export key material -- unwrapped, wrapped to an enrolled principal, or re-wrapped to a page-held key.
POST /api/keys/expire	Bearer + DPoP	Expire keys -- or, with remove: true, DELETE them irreversibly.