Rotate keys with KMS

Canton supports both rotating the wrapper key when using envelope encryption, and rotating Canton keys stored externally in a KMS.

For smooth disaster recovery, key rotation must be interleaved with backups as described under Backup and Restore.