pub fn ensure_keys_string() -> Result<(String, bool)>
Get nsec string, ensuring keys file exists (generate if needed) Returns (nsec_string, was_generated)