AES-256-GCM in the pre-rotation layout: nonce || ciphertext || tag, with
no key id. Retained because it is what every value written before 1.0 looks
like, and KeyRing still reads that form — new deployments should use
KeyRing, which is what the server wires up.
One active key for sealing plus any number of retired keys kept only for
opening. This is what makes the master key rotatable: run with both, rewrap
the store, then drop the old key.
v1 master key source: a hex-encoded 32-byte key from an env var, or (if
the env var holds a path instead) read from a file. Swappable later for
a KMS-backed provider without touching Barrier or its callers.
Identifies a key by a prefix of its own SHA-256, rather than by a
configured label. Nothing to keep in sync between replicas, and an
operator cannot mislabel a key.