pub fn load_primary_key() -> SshCliResult<(Option<[u8; 32]>, KeySource)>
Resolves primary key and source (does not auto-create).
Returns an error if a configured key source exists but cannot be read or parsed.