pub fn key_id(key: &[u8; 32]) -> u32
Identifies a key by a prefix of its own SHA-256, rather than by a configured label. Nothing to keep in sync between replicas, and an operator cannot mislabel a key.