Key lifecycle

Creating, reading, exporting and expiring keys.

Operation	Auth	Purpose
POST /api/v1/keys/template	Bearer + DPoP	Mint a key from a named template, or from the default one.
POST /api/v1/keys/get	Bearer + DPoP	Read a key's metadata by hidden link.
POST /api/v1/keys/export	Bearer + DPoP	Export key material -- unwrapped, wrapped to an enrolled principal, or re-wrapped to a page-held key.
POST /api/v1/keys/expire	Bearer + DPoP	Expire keys -- every later use is refused, and each key's record is kept.
POST /api/v1/keys/remove	Bearer + DPoP	Remove keys -- delete each key, its access control list and every cached copy.
POST /api/v1/keys/import	Bearer + DPoP	Import keys -- a peer key server's (NATIVE) or your own (RAW, WRAPPED).