Make it clear what to do if encryption/decryption fails

[shyiko]

e.g. gcloud auth application-default login or GOOGLE_APPLICATION_CREDENTIALS=/path/to/credentials.json might be needed in case of Google Cloud KMS backend.

[philicious]

its also handy to check the permissions someone has on a certain keyring/key. to ensure someone has or doesnt have access

export TOKEN=$(gcloud beta auth application-default print-access-token)
# fill in PROJECT_ID, LOCATION_OF_KEYRING, KEYRING_NAME, KEY_NAME
curl -X POST -H "Content-Type: application/json" -d '{"permissions": ["cloudkms.cryptoKeyVersions.useToDecrypt","cloudkms.cryptoKeyVersions.useToEncrypt"]}' -H "Authorization: Bearer $TOKEN" https://cloudkms.googleapis.com/v1/projects/PROJECT_ID/locations/LOCATION_OF_KEYRING/keyRings/KEYRING_NAME/cryptoKeys/KEY_NAME:testIamPermissions

if the user HAS permissions, it will respond with

{
  "permissions": [
    "cloudkms.cryptoKeyVersions.useToDecrypt",
    "cloudkms.cryptoKeyVersions.useToEncrypt"
  ]
}

oherwise the array is empty