pub fn generate_key(person: &str) -> Result<String>
Generates a new bearer key: gk-<person-slug>-<48 hex chars>.
gk-<person-slug>-<48 hex chars>
Fails only if the OS CSPRNG is unavailable.