Flexible key manager policy signers

[kostko]

Currently the set of key manager policy signers is hard-coded. While the set must be compiled into the key manager and key manager client binaries for security reasons, we should make it so that people can easily build key managers with a different set. This is required so that people can develop their own runtimes which use their own key managers.

One way to do it is to have all key manager functionality exposed as a library crate and then the actual key manager implementation only needs to provide the set of key manager policy signers.