Key ACLs

Who may reach a key, and with which rights.

Operation	Auth	Purpose
POST /api/v1/keys/acl/get	Bearer + DPoP	Read a key's ACL.
POST /api/v1/keys/acl/grant	Bearer + DPoP	Add an ACL entry giving a principal rights over a key.
POST /api/v1/keys/acl/update	Bearer + DPoP	Amend an existing ACL entry to a given rights mask.
POST /api/v1/keys/acl/revoke	Bearer + DPoP	Remove a principal's ACL entry entirely.
POST /api/v1/keys/acl/checkout	Bearer + DPoP	Check out the caller's ACL entries on keys.
POST /api/v1/keys/authorize	Bearer + DPoP	Ask whether the caller may use the key behind a hidden link.