Per-tenant root keys (bring your own key) #174

A tenant's master key wrapped by a key the tenant controls, so revoking or destroying it shreds the tenant's data immediately, backups included.

• A tenant setting names a root key (provider + key reference) that the provider validates. The tenant's master key is wrapped by that key instead of the deployment root, and gets no operator recovery wrap. Revoking or destroying the tenant's key makes its data unreadable everywhere, backups included. The ring re-validates such keys periodically (for example hourly) so a revocation takes effect within that period.