feat(consensus): encrypt signing keys at rest

[SuperFluffy]

Adds passphrase-encrypted consensus signing-key support and pipe-based passphrase loading for node startup and CLI key utilities.

New and updated CLI:

# Encrypt existing signing keys
tempo consensus encrypt-signing-key --input <FILE> --output <FILE> --secret <PIPE> [--force]

# New optional --secret <PIPE> arg to generate new signing keys with encryption
# Maintains old alias generate-public-key
tempo consensus generate-signing-key --output <FILE> [--secret <PIPE>] [--force]

# New optional --secret <PIPE> to show the verification key for encrypted signing keys
# Maintains old alias calculate-public-key
tempo consensus show-verification-key --private-key <FILE> [--secret <PIPE>]

# New optional --secret <PIPE> to decrypt encrypted signing keys at startup
tempo node --consensus.signing-key <FILE> [--consensus.secret <PIPE>]

The argument --secret <PIPE> accepts all Paths, but FIFOs (named pipes) and shell process substitution paths such as <(...) are preferred.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	age@​0.11.3
	secrecy@​0.10.3

View full report

[codspeed-hq]

Merging this PR will not alter performance

✅ 9 untouched benchmarks

---

_{Comparing janis/encrypt-signing-key (6a885af) with main (adb349f)}

[hamdiallam]

TIL about fifo. Pretty cool